Attack Type Prediction Using Decision Tree, KNN, ANN and K-Means

Importing Required Libraries

In [1]:
import numpy as np
import pandas as pd
import matplotlib.pyplot as plt
import seaborn as sns
from sklearn.preprocessing import LabelEncoder
from sklearn.model_selection import train_test_split, GridSearchCV
from sklearn.tree import DecisionTreeClassifier
from sklearn.metrics import confusion_matrix, f1_score, accuracy_score, precision_score, recall_score
from sklearn.feature_selection import mutual_info_classif
from sklearn.tree import export_graphviz
from IPython.display import SVG, display
import graphviz
from sklearn.neural_network import MLPClassifier
from sklearn.preprocessing import StandardScaler
from sklearn.neighbors import KNeighborsClassifier
from sklearn.cluster import KMeans
from sklearn.decomposition import PCA
from sklearn.preprocessing import StandardScaler
from mpl_toolkits.mplot3d import Axes3D
In [2]:
!pip install graphviz
Requirement already satisfied: graphviz in /home/jawad_ahmed/anaconda3/lib/python3.7/site-packages (0.20.1)
In [3]:
dataset = pd.read_csv('Dataset.txt', sep=',')
In [4]:
attack_types = pd.read_csv('Attack_types.txt', sep=' ')
In [5]:
dataset.head()
Out[5]:
duration protocol_type service flag src_bytes dst_bytes land wrong_fragment urgent hot ... dst_host_same_srv_rate dst_host_diff_srv_rate dst_host_same_src_port_rate dst_host_srv_diff_host_rate dst_host_serror_rate dst_host_srv_serror_rate dst_host_rerror_rate dst_host_srv_rerror_rate attack_category occurance
0 0 tcp ftp_data SF 491 0 0 0 0 0 ... 0.17 0.03 0.17 0.00 0.00 0.00 0.05 0.00 normal 20
1 0 udp other SF 146 0 0 0 0 0 ... 0.00 0.60 0.88 0.00 0.00 0.00 0.00 0.00 normal 15
2 0 tcp private S0 0 0 0 0 0 0 ... 0.10 0.05 0.00 0.00 1.00 1.00 0.00 0.00 neptune 19
3 0 tcp http SF 232 8153 0 0 0 0 ... 1.00 0.00 0.03 0.04 0.03 0.01 0.00 0.01 normal 21
4 0 tcp http SF 199 420 0 0 0 0 ... 1.00 0.00 0.00 0.00 0.00 0.00 0.00 0.00 normal 21

5 rows × 43 columns

In [6]:
dataset.tail()
Out[6]:
duration protocol_type service flag src_bytes dst_bytes land wrong_fragment urgent hot ... dst_host_same_srv_rate dst_host_diff_srv_rate dst_host_same_src_port_rate dst_host_srv_diff_host_rate dst_host_serror_rate dst_host_srv_serror_rate dst_host_rerror_rate dst_host_srv_rerror_rate attack_category occurance
125968 0 tcp private S0 0 0 0 0 0 0 ... 0.10 0.06 0.00 0.0 1.00 1.0 0.00 0.0 neptune 20
125969 8 udp private SF 105 145 0 0 0 0 ... 0.96 0.01 0.01 0.0 0.00 0.0 0.00 0.0 normal 21
125970 0 tcp smtp SF 2231 384 0 0 0 0 ... 0.12 0.06 0.00 0.0 0.72 0.0 0.01 0.0 normal 18
125971 0 tcp klogin S0 0 0 0 0 0 0 ... 0.03 0.05 0.00 0.0 1.00 1.0 0.00 0.0 neptune 20
125972 0 tcp ftp_data SF 151 0 0 0 0 0 ... 0.30 0.03 0.30 0.0 0.00 0.0 0.00 0.0 normal 21

5 rows × 43 columns

In [7]:
dataset.info()
<class 'pandas.core.frame.DataFrame'>
RangeIndex: 125973 entries, 0 to 125972
Data columns (total 43 columns):
 #   Column                       Non-Null Count   Dtype  
---  ------                       --------------   -----  
 0   duration                     125973 non-null  int64  
 1   protocol_type                125973 non-null  object 
 2   service                      125973 non-null  object 
 3   flag                         125973 non-null  object 
 4   src_bytes                    125973 non-null  int64  
 5   dst_bytes                    125973 non-null  int64  
 6   land                         125973 non-null  int64  
 7   wrong_fragment               125973 non-null  int64  
 8   urgent                       125973 non-null  int64  
 9   hot                          125973 non-null  int64  
 10  num_failed_logins            125973 non-null  int64  
 11  logged_in                    125973 non-null  int64  
 12  num_compromised              125973 non-null  int64  
 13  root_shell                   125973 non-null  int64  
 14  su_attempted                 125973 non-null  int64  
 15  num_root                     125973 non-null  int64  
 16  num_file_creations           125973 non-null  int64  
 17  num_shells                   125973 non-null  int64  
 18  num_access_files             125973 non-null  int64  
 19  num_outbound_cmds            125973 non-null  int64  
 20  is_host_login                125973 non-null  int64  
 21  is_guest_login               125973 non-null  int64  
 22  count                        125973 non-null  int64  
 23  srv_count                    125973 non-null  int64  
 24  serror_rate                  125973 non-null  float64
 25  srv_serror_rate              125973 non-null  float64
 26  rerror_rate                  125973 non-null  float64
 27  srv_rerror_rate              125973 non-null  float64
 28  same_srv_rate                125973 non-null  float64
 29  diff_srv_rate                125973 non-null  float64
 30  srv_diff_host_rate           125973 non-null  float64
 31  dst_host_count               125973 non-null  int64  
 32  dst_host_srv_count           125973 non-null  int64  
 33  dst_host_same_srv_rate       125973 non-null  float64
 34  dst_host_diff_srv_rate       125973 non-null  float64
 35  dst_host_same_src_port_rate  125973 non-null  float64
 36  dst_host_srv_diff_host_rate  125973 non-null  float64
 37  dst_host_serror_rate         125973 non-null  float64
 38  dst_host_srv_serror_rate     125973 non-null  float64
 39  dst_host_rerror_rate         125973 non-null  float64
 40  dst_host_srv_rerror_rate     125973 non-null  float64
 41  attack_category              125973 non-null  object 
 42  occurance                    125973 non-null  int64  
dtypes: float64(15), int64(24), object(4)
memory usage: 41.3+ MB
In [8]:
dataset.describe()
Out[8]:
duration src_bytes dst_bytes land wrong_fragment urgent hot num_failed_logins logged_in num_compromised ... dst_host_srv_count dst_host_same_srv_rate dst_host_diff_srv_rate dst_host_same_src_port_rate dst_host_srv_diff_host_rate dst_host_serror_rate dst_host_srv_serror_rate dst_host_rerror_rate dst_host_srv_rerror_rate occurance
count 125973.00000 1.259730e+05 1.259730e+05 125973.000000 125973.000000 125973.000000 125973.000000 125973.000000 125973.000000 125973.000000 ... 125973.000000 125973.000000 125973.000000 125973.000000 125973.000000 125973.000000 125973.000000 125973.000000 125973.000000 125973.000000
mean 287.14465 4.556674e+04 1.977911e+04 0.000198 0.022687 0.000111 0.204409 0.001222 0.395736 0.279250 ... 115.653005 0.521242 0.082951 0.148379 0.032542 0.284452 0.278485 0.118832 0.120240 19.504060
std 2604.51531 5.870331e+06 4.021269e+06 0.014086 0.253530 0.014366 2.149968 0.045239 0.489010 23.942042 ... 110.702741 0.448949 0.188922 0.308997 0.112564 0.444784 0.445669 0.306557 0.319459 2.291503
min 0.00000 0.000000e+00 0.000000e+00 0.000000 0.000000 0.000000 0.000000 0.000000 0.000000 0.000000 ... 0.000000 0.000000 0.000000 0.000000 0.000000 0.000000 0.000000 0.000000 0.000000 0.000000
25% 0.00000 0.000000e+00 0.000000e+00 0.000000 0.000000 0.000000 0.000000 0.000000 0.000000 0.000000 ... 10.000000 0.050000 0.000000 0.000000 0.000000 0.000000 0.000000 0.000000 0.000000 18.000000
50% 0.00000 4.400000e+01 0.000000e+00 0.000000 0.000000 0.000000 0.000000 0.000000 0.000000 0.000000 ... 63.000000 0.510000 0.020000 0.000000 0.000000 0.000000 0.000000 0.000000 0.000000 20.000000
75% 0.00000 2.760000e+02 5.160000e+02 0.000000 0.000000 0.000000 0.000000 0.000000 1.000000 0.000000 ... 255.000000 1.000000 0.070000 0.060000 0.020000 1.000000 1.000000 0.000000 0.000000 21.000000
max 42908.00000 1.379964e+09 1.309937e+09 1.000000 3.000000 3.000000 77.000000 5.000000 1.000000 7479.000000 ... 255.000000 1.000000 1.000000 1.000000 1.000000 1.000000 1.000000 1.000000 1.000000 21.000000

8 rows × 39 columns

In [9]:
attack_types.head()
Out[9]:
attack_category attack_type
0 apache2 dos
1 back dos
2 mailbomb dos
3 processtable dos
4 snmpgetattack dos
In [10]:
attack_types.tail()
Out[10]:
attack_category attack_type
36 portsweep probe
37 satan probe
38 mscan probe
39 saint probe
40 worm probe
In [11]:
attack_types.describe()
Out[11]:
attack_category attack_type
count 41 41
unique 39 4
top worm r2l
freq 2 15
In [12]:
attack_types.info()
<class 'pandas.core.frame.DataFrame'>
RangeIndex: 41 entries, 0 to 40
Data columns (total 2 columns):
 #   Column           Non-Null Count  Dtype 
---  ------           --------------  ----- 
 0   attack_category  41 non-null     object
 1   attack_type      41 non-null     object
dtypes: object(2)
memory usage: 784.0+ bytes

Data Visualization

In [13]:
# Add a Target Column (Attack Type in the Data Set)
attack_types_dict = attack_types.set_index('attack_category')['attack_type'].to_dict()
target_column_list = []
for attack_category in dataset['attack_category']:
    if (attack_category == 'normal'):
        target_column_list.append('normal')
    else:
        target_column_list.append(attack_types_dict[attack_category])

dataset['attack_type'] = target_column_list
In [14]:
dataset.head()
Out[14]:
duration protocol_type service flag src_bytes dst_bytes land wrong_fragment urgent hot ... dst_host_diff_srv_rate dst_host_same_src_port_rate dst_host_srv_diff_host_rate dst_host_serror_rate dst_host_srv_serror_rate dst_host_rerror_rate dst_host_srv_rerror_rate attack_category occurance attack_type
0 0 tcp ftp_data SF 491 0 0 0 0 0 ... 0.03 0.17 0.00 0.00 0.00 0.05 0.00 normal 20 normal
1 0 udp other SF 146 0 0 0 0 0 ... 0.60 0.88 0.00 0.00 0.00 0.00 0.00 normal 15 normal
2 0 tcp private S0 0 0 0 0 0 0 ... 0.05 0.00 0.00 1.00 1.00 0.00 0.00 neptune 19 dos
3 0 tcp http SF 232 8153 0 0 0 0 ... 0.00 0.03 0.04 0.03 0.01 0.00 0.01 normal 21 normal
4 0 tcp http SF 199 420 0 0 0 0 ... 0.00 0.00 0.00 0.00 0.00 0.00 0.00 normal 21 normal

5 rows × 44 columns

In [15]:
dataset.tail()
Out[15]:
duration protocol_type service flag src_bytes dst_bytes land wrong_fragment urgent hot ... dst_host_diff_srv_rate dst_host_same_src_port_rate dst_host_srv_diff_host_rate dst_host_serror_rate dst_host_srv_serror_rate dst_host_rerror_rate dst_host_srv_rerror_rate attack_category occurance attack_type
125968 0 tcp private S0 0 0 0 0 0 0 ... 0.06 0.00 0.0 1.00 1.0 0.00 0.0 neptune 20 dos
125969 8 udp private SF 105 145 0 0 0 0 ... 0.01 0.01 0.0 0.00 0.0 0.00 0.0 normal 21 normal
125970 0 tcp smtp SF 2231 384 0 0 0 0 ... 0.06 0.00 0.0 0.72 0.0 0.01 0.0 normal 18 normal
125971 0 tcp klogin S0 0 0 0 0 0 0 ... 0.05 0.00 0.0 1.00 1.0 0.00 0.0 neptune 20 dos
125972 0 tcp ftp_data SF 151 0 0 0 0 0 ... 0.03 0.30 0.0 0.00 0.0 0.00 0.0 normal 21 normal

5 rows × 44 columns

In [16]:
attack_types.head()
Out[16]:
attack_category attack_type
0 apache2 dos
1 back dos
2 mailbomb dos
3 processtable dos
4 snmpgetattack dos
In [17]:
attack_types.tail()
Out[17]:
attack_category attack_type
36 portsweep probe
37 satan probe
38 mscan probe
39 saint probe
40 worm probe
In [18]:
attack_types_count = dataset['attack_type'].value_counts()
In [19]:
colors = ['red', 'blue', 'green', 'orange']
In [20]:
fig = plt.figure(figsize=(10,10))
plt.bar(attack_types_count.index, attack_types_count.values, color=colors)

plt.title('Attack Types Frequecies')
plt.xlabel('Attacks')
plt.ylabel('Frequency')

# save the figure as PNG Image
fig.savefig('attack_types_frequencies')

Inference:

  1. The graph shows that normal has the highest frequency that mean there are no attacks normally.
  2. Second dos attack has the highest frequency.
  3. Third probe attack has the highest freuqecny.
In [21]:
attack_categories_count = dataset['attack_category'].value_counts()
In [22]:
fig = plt.figure(figsize=(30,20))
plt.bar(attack_categories_count.index, attack_categories_count.values, color=colors)

plt.title('Attack Categories Frequecies')
plt.xlabel('Attack Categories')
plt.ylabel('Frequency')

plt.xticks(rotation=45)
# save the figure as PNG Image
fig.savefig('attack_categories_frequencies')

Inference:

  1. The graph shows that normal attack category has the highest frequency.
  2. Second neptune has the highest frequency that correspond the dos attack.
  3. Third satan has the highest frequency that correspond to the probe attack.

Label Encoding the Categorical Columns

In [23]:
dataset.head()
Out[23]:
duration protocol_type service flag src_bytes dst_bytes land wrong_fragment urgent hot ... dst_host_diff_srv_rate dst_host_same_src_port_rate dst_host_srv_diff_host_rate dst_host_serror_rate dst_host_srv_serror_rate dst_host_rerror_rate dst_host_srv_rerror_rate attack_category occurance attack_type
0 0 tcp ftp_data SF 491 0 0 0 0 0 ... 0.03 0.17 0.00 0.00 0.00 0.05 0.00 normal 20 normal
1 0 udp other SF 146 0 0 0 0 0 ... 0.60 0.88 0.00 0.00 0.00 0.00 0.00 normal 15 normal
2 0 tcp private S0 0 0 0 0 0 0 ... 0.05 0.00 0.00 1.00 1.00 0.00 0.00 neptune 19 dos
3 0 tcp http SF 232 8153 0 0 0 0 ... 0.00 0.03 0.04 0.03 0.01 0.00 0.01 normal 21 normal
4 0 tcp http SF 199 420 0 0 0 0 ... 0.00 0.00 0.00 0.00 0.00 0.00 0.00 normal 21 normal

5 rows × 44 columns

In [24]:
categorical_cols = ['protocol_type', 'service', 'flag', 'attack_category', 'attack_type']
In [25]:
label_encoder = LabelEncoder()
for category_col in categorical_cols:
    dataset[category_col] = label_encoder.fit_transform(dataset[category_col])
In [26]:
dataset.head()
Out[26]:
duration protocol_type service flag src_bytes dst_bytes land wrong_fragment urgent hot ... dst_host_diff_srv_rate dst_host_same_src_port_rate dst_host_srv_diff_host_rate dst_host_serror_rate dst_host_srv_serror_rate dst_host_rerror_rate dst_host_srv_rerror_rate attack_category occurance attack_type
0 0 1 20 9 491 0 0 0 0 0 ... 0.03 0.17 0.00 0.00 0.00 0.05 0.00 11 20 1
1 0 2 44 9 146 0 0 0 0 0 ... 0.60 0.88 0.00 0.00 0.00 0.00 0.00 11 15 1
2 0 1 49 5 0 0 0 0 0 0 ... 0.05 0.00 0.00 1.00 1.00 0.00 0.00 9 19 0
3 0 1 24 9 232 8153 0 0 0 0 ... 0.00 0.03 0.04 0.03 0.01 0.00 0.01 11 21 1
4 0 1 24 9 199 420 0 0 0 0 ... 0.00 0.00 0.00 0.00 0.00 0.00 0.00 11 21 1

5 rows × 44 columns

Correlation Matrix For Selecting Five Best Features

In [27]:
corr_matrix = dataset.corr()
fig, ax = plt.subplots(figsize=(40, 40))
cmap = sns.color_palette("plasma")
sns.heatmap(corr_matrix, cmap=cmap, center=0, square=True, annot=True, annot_kws={'fontsize': 12}, linewidths=.5, ax=ax)
ax.tick_params(axis='both', labelsize=14)
ax.set_title('Correlation Matrix', fontsize=18)
fig.savefig('correlation_matrix_of_dataset.png', dpi=300, bbox_inches='tight')
plt.show()

Inference:

  1. The graph shows that attack_type is highly correlated with serror_rate with r = -0.67 negatively correlated.
  2. The graph shows that attack_type is highly correlated with flag with r = 0.41 positively correlated.
  3. The feature 'serror_rate' is higly correlated with 'dst_host_srv_rerror_rate' with r = 0.98 highly positively correlated and with the target column 'serror_rate' r = -0.67 and 'dst_host_srv_rerror_rate' has the r = 0.0082 that mean we will select 'serror_rate' as compared to dst_host_srv_rerror_rate becuase both are higly correlated with each other but with the target column serror_rate is more highly correlated.
In [28]:
corr_matrix = dataset.corr()
corr_target = corr_matrix['attack_type']
top_5_cols = corr_target.abs().sort_values(ascending=False)[1:6]
if 'attack_type' in top_5_cols:
    top_5_cols = top_5_cols.drop(target_var)
top_5_cols_using_corr = top_5_cols.index.tolist()
top_5_cols_using_corr
Out[28]:
['dst_host_srv_serror_rate',
 'dst_host_serror_rate',
 'srv_serror_rate',
 'serror_rate',
 'same_srv_rate']
In [29]:
best_feautres_using_corr = dataset[top_5_cols_using_corr]
In [30]:
best_feautres_using_corr.head()
Out[30]:
dst_host_srv_serror_rate dst_host_serror_rate srv_serror_rate serror_rate same_srv_rate
0 0.00 0.00 0.0 0.0 1.00
1 0.00 0.00 0.0 0.0 0.08
2 1.00 1.00 1.0 1.0 0.05
3 0.01 0.03 0.2 0.2 1.00
4 0.00 0.00 0.0 0.0 1.00
In [31]:
best_feautres_using_corr.describe()
Out[31]:
dst_host_srv_serror_rate dst_host_serror_rate srv_serror_rate serror_rate same_srv_rate
count 125973.000000 125973.000000 125973.000000 125973.000000 125973.000000
mean 0.278485 0.284452 0.282485 0.284485 0.660928
std 0.445669 0.444784 0.447022 0.446456 0.439623
min 0.000000 0.000000 0.000000 0.000000 0.000000
25% 0.000000 0.000000 0.000000 0.000000 0.090000
50% 0.000000 0.000000 0.000000 0.000000 1.000000
75% 1.000000 1.000000 1.000000 1.000000 1.000000
max 1.000000 1.000000 1.000000 1.000000 1.000000
In [32]:
best_feautres_using_corr.info()
<class 'pandas.core.frame.DataFrame'>
RangeIndex: 125973 entries, 0 to 125972
Data columns (total 5 columns):
 #   Column                    Non-Null Count   Dtype  
---  ------                    --------------   -----  
 0   dst_host_srv_serror_rate  125973 non-null  float64
 1   dst_host_serror_rate      125973 non-null  float64
 2   srv_serror_rate           125973 non-null  float64
 3   serror_rate               125973 non-null  float64
 4   same_srv_rate             125973 non-null  float64
dtypes: float64(5)
memory usage: 4.8 MB
In [33]:
corr_matrix = best_feautres_using_corr.corr()
fig, ax = plt.subplots(figsize=(40, 40))
cmap = sns.color_palette("plasma")
sns.heatmap(corr_matrix, cmap=cmap, center=0, square=True, annot=True, annot_kws={'fontsize': 12}, linewidths=.5, ax=ax)
ax.tick_params(axis='both', labelsize=14)
ax.set_title('Correlation Matrix', fontsize=18)
fig.savefig('correlation_matrix_of_features_selected_using_corr.png', dpi=300, bbox_inches='tight')
plt.show()

Applying Decision Tree Model On Features Selected Using Corr Matrix

1. Entropy Criteria

Split the Data Set into traning and testing dataset

In [34]:
X = best_feautres_using_corr
y = dataset['attack_type']

X_train, X_test, y_train, y_test = train_test_split(X, y, test_size=0.2, random_state=42)
In [35]:
X_train.shape
Out[35]:
(100778, 5)
In [36]:
X_test.shape
Out[36]:
(25195, 5)
In [37]:
y_train.shape
Out[37]:
(100778,)
In [38]:
y_test.shape
Out[38]:
(25195,)
In [39]:
y_test.head()
Out[39]:
378      1
32038    0
86399    0
74412    0
52951    2
Name: attack_type, dtype: int64
In [40]:
y_train.head()
Out[40]:
95141    1
37486    0
34926    0
34589    1
11420    1
Name: attack_type, dtype: int64
In [41]:
X_train.head()
Out[41]:
dst_host_srv_serror_rate dst_host_serror_rate srv_serror_rate serror_rate same_srv_rate
95141 0.0 0.0 0.0 0.0 1.00
37486 1.0 1.0 1.0 1.0 0.01
34926 0.0 0.0 0.0 0.0 0.03
34589 0.0 0.0 0.0 0.0 1.00
11420 0.0 0.0 0.0 0.0 1.00
In [42]:
X_test.head()
Out[42]:
dst_host_srv_serror_rate dst_host_serror_rate srv_serror_rate serror_rate same_srv_rate
378 0.0 0.00 0.0 0.0 1.00
32038 1.0 1.00 1.0 1.0 0.26
86399 1.0 1.00 1.0 1.0 0.07
74412 0.0 0.00 0.0 0.0 0.07
52951 0.0 0.04 0.0 0.0 1.00
In [43]:
X_test.tail()
Out[43]:
dst_host_srv_serror_rate dst_host_serror_rate srv_serror_rate serror_rate same_srv_rate
114267 0.00 0.00 0.0 0.0 1.0
69047 0.00 0.00 0.0 0.0 1.0
56135 0.00 0.00 0.0 0.0 1.0
103927 0.02 0.02 0.0 0.0 1.0
33190 1.00 1.00 1.0 1.0 0.1
In [44]:
X_train.describe()
Out[44]:
dst_host_srv_serror_rate dst_host_serror_rate srv_serror_rate serror_rate same_srv_rate
count 100778.000000 100778.000000 100778.000000 100778.000000 100778.000000
mean 0.278298 0.284417 0.282333 0.284440 0.660844
std 0.445590 0.444807 0.446940 0.446421 0.439646
min 0.000000 0.000000 0.000000 0.000000 0.000000
25% 0.000000 0.000000 0.000000 0.000000 0.090000
50% 0.000000 0.000000 0.000000 0.000000 1.000000
75% 1.000000 1.000000 1.000000 1.000000 1.000000
max 1.000000 1.000000 1.000000 1.000000 1.000000
In [45]:
X_test.describe()
Out[45]:
dst_host_srv_serror_rate dst_host_serror_rate srv_serror_rate serror_rate same_srv_rate
count 25195.000000 25195.000000 25195.000000 25195.000000 25195.000000
mean 0.279232 0.284594 0.283095 0.284662 0.661262
std 0.445993 0.444702 0.447359 0.446602 0.439539
min 0.000000 0.000000 0.000000 0.000000 0.000000
25% 0.000000 0.000000 0.000000 0.000000 0.090000
50% 0.000000 0.000000 0.000000 0.000000 1.000000
75% 1.000000 1.000000 1.000000 1.000000 1.000000
max 1.000000 1.000000 1.000000 1.000000 1.000000
In [46]:
clf_using_corr_entropy = DecisionTreeClassifier(criterion='entropy', random_state=42)
clf_using_corr_entropy.fit(X_train, y_train)
Out[46]:
DecisionTreeClassifier(criterion='entropy', random_state=42)
In [47]:
y_pred = clf_using_corr_entropy.predict(X_test)
In [48]:
accuracy = accuracy_score(y_test, y_pred)

print('Accuracy:', accuracy)
Accuracy: 0.8805715419726136

Confusion Matrix

In [49]:
cm = confusion_matrix(y_test, y_pred)
# calculate F1 score
f1 = f1_score(y_test, y_pred, average='weighted')
print("F1 Score:", f1)

# calculate accuracy
accuracy = accuracy_score(y_test, y_pred)
print("Accuracy:", accuracy)

# calculate error rate
error_rate = 1 - accuracy
print("Error Rate:", error_rate)

# plot confusion matrix
sns.heatmap(cm, annot=True, cmap="Blues")
plt.title("Confusion Matrix")
plt.xlabel("Predicted Labels")
plt.ylabel("True Labels")

plt.savefig("cm_dt_corr_entropy.png")
plt.show() 
F1 Score: 0.8622577711672988
Accuracy: 0.8805715419726136
Error Rate: 0.11942845802738644

Inference:

  1. The diagnol shows correctly predicted values. The attack is actually 0 and the model also predicted it as 0 same goes for all the diagnol values like second rows diagnol true value is 1 predicted value is also 1.
  2. The confusion matrix shows that 8.2e + 03 values are predicted correctely True value is 0 and the predicted value is also 0.
  3. Second row first column shows that 1.1e+02 values are predicted wrong True value is 1 but model predicted it as 0.
  4. Same goes for all the confusion matrix.
In [50]:
# Visualize the decision tree
dot_data = export_graphviz(clf_using_corr_entropy, out_file=None, 
                           feature_names=top_5_cols_using_corr,  
                           class_names='attack_type',  
                           filled=True, rounded=True,  
                           special_characters=True)  
# graph = graphviz.Source(dot_data)  
# graph.render("iris_decision_tree")
graph = graphviz.Source(dot_data)
display(SVG(graph.pipe(format='svg')))
Tree 0 same_srv_rate ≤ 0.495 entropy = 1.389 samples = 100778 value = [36746, 53921, 9299, 771, 41] class = t 1 dst_host_serror_rate ≤ 0.785 entropy = 0.621 samples = 36438 value = [32257, 1433, 2746, 0, 2] class = a 0->1 True 228 dst_host_serror_rate ≤ 0.965 entropy = 0.926 samples = 64340 value = [4489, 52488, 6553, 771, 39] class = t 0->228 False 2 dst_host_serror_rate ≤ 0.005 entropy = 1.38 samples = 9773 value = [5613, 1414, 2744, 0, 2] class = a 1->2 221 dst_host_srv_serror_rate ≤ 0.03 entropy = 0.01 samples = 26665 value = [26644, 19, 2, 0, 0] class = a 1->221 3 same_srv_rate ≤ 0.165 entropy = 1.129 samples = 7612 value = [5495, 1222, 893, 0, 2] class = a 2->3 124 same_srv_rate ≤ 0.035 entropy = 0.731 samples = 2161 value = [118, 192, 1851, 0, 0] class = t 2->124 4 serror_rate ≤ 0.005 entropy = 0.821 samples = 6355 value = [5276, 392, 685, 0, 2] class = a 3->4 47 same_srv_rate ≤ 0.195 entropy = 1.264 samples = 1257 value = [219, 830, 208, 0, 0] class = t 3->47 5 same_srv_rate ≤ 0.095 entropy = 0.744 samples = 6183 value = [5276, 364, 543, 0, 0] class = a 4->5 42 same_srv_rate ≤ 0.035 entropy = 0.729 samples = 172 value = [0, 28, 142, 0, 2] class = t 4->42 6 same_srv_rate ≤ 0.005 entropy = 0.619 samples = 4788 value = [4215, 124, 449, 0, 0] class = a 5->6 27 same_srv_rate ≤ 0.135 entropy = 0.999 samples = 1395 value = [1061, 240, 94, 0, 0] class = a 5->27 7 entropy = 1.331 samples = 272 value = [140, 24, 108, 0, 0] class = a 6->7 8 same_srv_rate ≤ 0.015 entropy = 0.537 samples = 4516 value = [4075, 100, 341, 0, 0] class = a 6->8 9 dst_host_srv_serror_rate ≤ 0.045 entropy = 0.792 samples = 577 value = [471, 14, 92, 0, 0] class = a 8->9 12 same_srv_rate ≤ 0.075 entropy = 0.49 samples = 3939 value = [3604, 86, 249, 0, 0] class = a 8->12 10 entropy = 0.788 samples = 576 value = [471, 14, 91, 0, 0] class = a 9->10 11 entropy = 0.0 samples = 1 value = [0, 0, 1, 0, 0] class = t 9->11 13 same_srv_rate ≤ 0.025 entropy = 0.427 samples = 3357 value = [3116, 52, 189, 0, 0] class = a 12->13 24 same_srv_rate ≤ 0.085 entropy = 0.79 samples = 582 value = [488, 34, 60, 0, 0] class = a 12->24 14 entropy = 0.536 samples = 588 value = [529, 10, 49, 0, 0] class = a 13->14 15 same_srv_rate ≤ 0.035 entropy = 0.401 samples = 2769 value = [2587, 42, 140, 0, 0] class = a 13->15 16 entropy = 0.349 samples = 540 value = [509, 4, 27, 0, 0] class = a 15->16 17 same_srv_rate ≤ 0.045 entropy = 0.413 samples = 2229 value = [2078, 38, 113, 0, 0] class = a 15->17 18 entropy = 0.495 samples = 554 value = [506, 12, 36, 0, 0] class = a 17->18 19 same_srv_rate ≤ 0.055 entropy = 0.383 samples = 1675 value = [1572, 26, 77, 0, 0] class = a 17->19 20 entropy = 0.332 samples = 540 value = [513, 9, 18, 0, 0] class = a 19->20 21 same_srv_rate ≤ 0.065 entropy = 0.406 samples = 1135 value = [1059, 17, 59, 0, 0] class = a 19->21 22 entropy = 0.387 samples = 573 value = [536, 6, 31, 0, 0] class = a 21->22 23 entropy = 0.423 samples = 562 value = [523, 11, 28, 0, 0] class = a 21->23 25 entropy = 0.877 samples = 353 value = [286, 23, 44, 0, 0] class = a 24->25 26 entropy = 0.638 samples = 229 value = [202, 11, 16, 0, 0] class = a 24->26 28 same_srv_rate ≤ 0.125 entropy = 0.845 samples = 918 value = [754, 105, 59, 0, 0] class = a 27->28 37 same_srv_rate ≤ 0.145 entropy = 1.201 samples = 477 value = [307, 135, 35, 0, 0] class = a 27->37 29 same_srv_rate ≤ 0.115 entropy = 0.96 samples = 700 value = [547, 101, 52, 0, 0] class = a 28->29 36 entropy = 0.336 samples = 218 value = [207, 4, 7, 0, 0] class = a 28->36 30 same_srv_rate ≤ 0.105 entropy = 0.84 samples = 419 value = [346, 41, 32, 0, 0] class = a 29->30 33 dst_host_srv_serror_rate ≤ 0.005 entropy = 1.093 samples = 281 value = [201, 60, 20, 0, 0] class = a 29->33 31 entropy = 0.867 samples = 219 value = [179, 22, 18, 0, 0] class = a 30->31 32 entropy = 0.808 samples = 200 value = [167, 19, 14, 0, 0] class = a 30->32 34 entropy = 1.083 samples = 280 value = [201, 60, 19, 0, 0] class = a 33->34 35 entropy = 0.0 samples = 1 value = [0, 0, 1, 0, 0] class = t 33->35 38 entropy = 1.258 samples = 300 value = [158, 124, 18, 0, 0] class = a 37->38 39 same_srv_rate ≤ 0.155 entropy = 0.783 samples = 177 value = [149, 11, 17, 0, 0] class = a 37->39 40 entropy = 0.887 samples = 105 value = [85, 8, 12, 0, 0] class = a 39->40 41 entropy = 0.609 samples = 72 value = [64, 3, 5, 0, 0] class = a 39->41 43 serror_rate ≤ 0.965 entropy = 0.106 samples = 144 value = [0, 0, 142, 0, 2] class = t 42->43 46 entropy = 0.0 samples = 28 value = [0, 28, 0, 0, 0] class = t 42->46 44 entropy = 0.0 samples = 141 value = [0, 0, 141, 0, 0] class = t 43->44 45 entropy = 0.918 samples = 3 value = [0, 0, 1, 0, 2] class = c 43->45 48 same_srv_rate ≤ 0.175 entropy = 1.499 samples = 228 value = [105, 80, 43, 0, 0] class = a 47->48 55 same_srv_rate ≤ 0.335 entropy = 1.108 samples = 1029 value = [114, 750, 165, 0, 0] class = t 47->55 49 serror_rate ≤ 0.085 entropy = 1.512 samples = 124 value = [46, 54, 24, 0, 0] class = t 48->49 52 same_srv_rate ≤ 0.185 entropy = 1.412 samples = 104 value = [59, 26, 19, 0, 0] class = a 48->52 50 entropy = 1.514 samples = 123 value = [46, 53, 24, 0, 0] class = t 49->50 51 entropy = 0.0 samples = 1 value = [0, 1, 0, 0, 0] class = t 49->51 53 entropy = 1.486 samples = 71 value = [36, 20, 15, 0, 0] class = a 52->53 54 entropy = 1.179 samples = 33 value = [23, 6, 4, 0, 0] class = a 52->54 56 same_srv_rate ≤ 0.325 entropy = 0.934 samples = 883 value = [78, 702, 103, 0, 0] class = t 55->56 93 same_srv_rate ≤ 0.395 entropy = 1.55 samples = 146 value = [36, 48, 62, 0, 0] class = t 55->93 57 same_srv_rate ≤ 0.255 entropy = 1.108 samples = 577 value = [76, 422, 79, 0, 0] class = t 56->57 88 serror_rate ≤ 0.085 entropy = 0.453 samples = 306 value = [2, 280, 24, 0, 0] class = t 56->88 58 same_srv_rate ≤ 0.205 entropy = 0.944 samples = 510 value = [58, 404, 48, 0, 0] class = t 57->58 75 same_srv_rate ≤ 0.315 entropy = 1.533 samples = 67 value = [18, 18, 31, 0, 0] class = t 57->75 59 serror_rate ≤ 0.1 entropy = 0.732 samples = 253 value = [17, 217, 19, 0, 0] class = t 58->59 64 same_srv_rate ≤ 0.245 entropy = 1.111 samples = 257 value = [41, 187, 29, 0, 0] class = t 58->64 60 dst_host_srv_serror_rate ≤ 0.005 entropy = 0.74 samples = 249 value = [17, 213, 19, 0, 0] class = t 59->60 63 entropy = 0.0 samples = 4 value = [0, 4, 0, 0, 0] class = t 59->63 61 entropy = 0.742 samples = 248 value = [17, 212, 19, 0, 0] class = t 60->61 62 entropy = 0.0 samples = 1 value = [0, 1, 0, 0, 0] class = t 60->62 65 same_srv_rate ≤ 0.225 entropy = 1.515 samples = 82 value = [31, 35, 16, 0, 0] class = t 64->65 72 dst_host_srv_serror_rate ≤ 0.005 entropy = 0.691 samples = 175 value = [10, 152, 13, 0, 0] class = t 64->72 66 same_srv_rate ≤ 0.215 entropy = 1.448 samples = 57 value = [17, 30, 10, 0, 0] class = t 65->66 69 same_srv_rate ≤ 0.235 entropy = 1.427 samples = 25 value = [14, 5, 6, 0, 0] class = a 65->69 67 entropy = 1.522 samples = 25 value = [10, 10, 5, 0, 0] class = a 66->67 68 entropy = 1.322 samples = 32 value = [7, 20, 5, 0, 0] class = t 66->68 70 entropy = 1.435 samples = 11 value = [6, 3, 2, 0, 0] class = a 69->70 71 entropy = 1.379 samples = 14 value = [8, 2, 4, 0, 0] class = a 69->71 73 entropy = 0.694 samples = 174 value = [10, 151, 13, 0, 0] class = t 72->73 74 entropy = 0.0 samples = 1 value = [0, 1, 0, 0, 0] class = t 72->74 76 same_srv_rate ≤ 0.285 entropy = 1.538 samples = 58 value = [14, 18, 26, 0, 0] class = t 75->76 87 entropy = 0.991 samples = 9 value = [4, 0, 5, 0, 0] class = t 75->87 77 same_srv_rate ≤ 0.275 entropy = 1.448 samples = 26 value = [7, 5, 14, 0, 0] class = t 76->77 82 same_srv_rate ≤ 0.295 entropy = 1.538 samples = 32 value = [7, 13, 12, 0, 0] class = t 76->82 78 same_srv_rate ≤ 0.265 entropy = 1.467 samples = 19 value = [5, 4, 10, 0, 0] class = t 77->78 81 entropy = 1.379 samples = 7 value = [2, 1, 4, 0, 0] class = t 77->81 79 entropy = 1.5 samples = 4 value = [1, 1, 2, 0, 0] class = t 78->79 80 entropy = 1.457 samples = 15 value = [4, 3, 8, 0, 0] class = t 78->80 83 entropy = 1.338 samples = 15 value = [2, 9, 4, 0, 0] class = t 82->83 84 same_srv_rate ≤ 0.305 entropy = 1.522 samples = 17 value = [5, 4, 8, 0, 0] class = t 82->84 85 entropy = 1.53 samples = 9 value = [3, 2, 4, 0, 0] class = t 84->85 86 entropy = 1.5 samples = 8 value = [2, 2, 4, 0, 0] class = t 84->86 89 dst_host_srv_serror_rate ≤ 0.025 entropy = 0.459 samples = 300 value = [2, 274, 24, 0, 0] class = t 88->89 92 entropy = 0.0 samples = 6 value = [0, 6, 0, 0, 0] class = t 88->92 90 entropy = 0.46 samples = 299 value = [2, 273, 24, 0, 0] class = t 89->90 91 entropy = 0.0 samples = 1 value = [0, 1, 0, 0, 0] class = t 89->91 94 same_srv_rate ≤ 0.355 entropy = 1.386 samples = 55 value = [23, 6, 26, 0, 0] class = t 93->94 105 same_srv_rate ≤ 0.405 entropy = 1.445 samples = 91 value = [13, 42, 36, 0, 0] class = t 93->105 95 same_srv_rate ≤ 0.345 entropy = 0.971 samples = 15 value = [9, 0, 6, 0, 0] class = a 94->95 98 same_srv_rate ≤ 0.385 entropy = 1.441 samples = 40 value = [14, 6, 20, 0, 0] class = t 94->98 96 entropy = 0.918 samples = 6 value = [4, 0, 2, 0, 0] class = a 95->96 97 entropy = 0.991 samples = 9 value = [5, 0, 4, 0, 0] class = a 95->97 99 same_srv_rate ≤ 0.375 entropy = 1.495 samples = 32 value = [11, 6, 15, 0, 0] class = t 98->99 104 entropy = 0.954 samples = 8 value = [3, 0, 5, 0, 0] class = t 98->104 100 same_srv_rate ≤ 0.365 entropy = 1.481 samples = 18 value = [8, 3, 7, 0, 0] class = a 99->100 103 entropy = 1.414 samples = 14 value = [3, 3, 8, 0, 0] class = t 99->103 101 entropy = 1.531 samples = 14 value = [5, 3, 6, 0, 0] class = t 100->101 102 entropy = 0.811 samples = 4 value = [3, 0, 1, 0, 0] class = a 100->102 106 entropy = 0.723 samples = 42 value = [2, 36, 4, 0, 0] class = t 105->106 107 same_srv_rate ≤ 0.415 entropy = 1.256 samples = 49 value = [11, 6, 32, 0, 0] class = t 105->107 108 entropy = 0.918 samples = 9 value = [3, 0, 6, 0, 0] class = t 107->108 109 same_srv_rate ≤ 0.485 entropy = 1.279 samples = 40 value = [8, 6, 26, 0, 0] class = t 107->109 110 same_srv_rate ≤ 0.475 entropy = 1.285 samples = 37 value = [7, 6, 24, 0, 0] class = t 109->110 123 entropy = 0.918 samples = 3 value = [1, 0, 2, 0, 0] class = t 109->123 111 same_srv_rate ≤ 0.455 entropy = 1.283 samples = 34 value = [7, 5, 22, 0, 0] class = t 110->111 122 entropy = 0.918 samples = 3 value = [0, 1, 2, 0, 0] class = t 110->122 112 same_srv_rate ≤ 0.445 entropy = 1.158 samples = 24 value = [4, 3, 17, 0, 0] class = t 111->112 119 same_srv_rate ≤ 0.465 entropy = 1.485 samples = 10 value = [3, 2, 5, 0, 0] class = t 111->119 113 same_srv_rate ≤ 0.425 entropy = 1.279 samples = 20 value = [4, 3, 13, 0, 0] class = t 112->113 118 entropy = 0.0 samples = 4 value = [0, 0, 4, 0, 0] class = t 112->118 114 entropy = 1.5 samples = 4 value = [1, 1, 2, 0, 0] class = t 113->114 115 same_srv_rate ≤ 0.435 entropy = 1.199 samples = 16 value = [3, 2, 11, 0, 0] class = t 113->115 116 entropy = 1.096 samples = 11 value = [2, 1, 8, 0, 0] class = t 115->116 117 entropy = 1.371 samples = 5 value = [1, 1, 3, 0, 0] class = t 115->117 120 entropy = 1.5 samples = 4 value = [1, 1, 2, 0, 0] class = t 119->120 121 entropy = 1.459 samples = 6 value = [2, 1, 3, 0, 0] class = t 119->121 125 serror_rate ≤ 0.89 entropy = 0.187 samples = 1572 value = [25, 13, 1534, 0, 0] class = t 124->125 134 serror_rate ≤ 0.02 entropy = 1.424 samples = 589 value = [93, 179, 317, 0, 0] class = t 124->134 126 entropy = 0.0 samples = 1533 value = [0, 0, 1533, 0, 0] class = t 125->126 127 dst_host_srv_serror_rate ≤ 0.655 entropy = 1.075 samples = 39 value = [25, 13, 1, 0, 0] class = a 125->127 128 dst_host_serror_rate ≤ 0.255 entropy = 0.567 samples = 15 value = [2, 13, 0, 0, 0] class = t 127->128 131 dst_host_serror_rate ≤ 0.1 entropy = 0.25 samples = 24 value = [23, 0, 1, 0, 0] class = a 127->131 129 entropy = 0.0 samples = 2 value = [2, 0, 0, 0, 0] class = a 128->129 130 entropy = 0.0 samples = 13 value = [0, 13, 0, 0, 0] class = t 128->130 132 entropy = 0.0 samples = 1 value = [0, 0, 1, 0, 0] class = t 131->132 133 entropy = 0.0 samples = 23 value = [23, 0, 0, 0, 0] class = a 131->133 135 dst_host_serror_rate ≤ 0.025 entropy = 0.384 samples = 307 value = [0, 23, 284, 0, 0] class = t 134->135 206 serror_rate ≤ 0.47 entropy = 1.362 samples = 282 value = [93, 156, 33, 0, 0] class = t 134->206 136 same_srv_rate ≤ 0.235 entropy = 0.748 samples = 75 value = [0, 16, 59, 0, 0] class = t 135->136 177 dst_host_serror_rate ≤ 0.165 entropy = 0.195 samples = 232 value = [0, 7, 225, 0, 0] class = t 135->177 137 same_srv_rate ≤ 0.055 entropy = 0.434 samples = 56 value = [0, 5, 51, 0, 0] class = t 136->137 164 dst_host_srv_serror_rate ≤ 0.01 entropy = 0.982 samples = 19 value = [0, 11, 8, 0, 0] class = t 136->164 138 entropy = 0.0 samples = 14 value = [0, 0, 14, 0, 0] class = t 137->138 139 dst_host_srv_serror_rate ≤ 0.005 entropy = 0.527 samples = 42 value = [0, 5, 37, 0, 0] class = t 137->139 140 same_srv_rate ≤ 0.075 entropy = 0.469 samples = 40 value = [0, 4, 36, 0, 0] class = t 139->140 161 dst_host_srv_serror_rate ≤ 0.02 entropy = 1.0 samples = 2 value = [0, 1, 1, 0, 0] class = t 139->161 141 entropy = 0.0 samples = 5 value = [0, 0, 5, 0, 0] class = t 140->141 142 same_srv_rate ≤ 0.085 entropy = 0.513 samples = 35 value = [0, 4, 31, 0, 0] class = t 140->142 143 dst_host_serror_rate ≤ 0.015 entropy = 0.811 samples = 4 value = [0, 1, 3, 0, 0] class = t 142->143 146 same_srv_rate ≤ 0.105 entropy = 0.459 samples = 31 value = [0, 3, 28, 0, 0] class = t 142->146 144 entropy = 0.918 samples = 3 value = [0, 1, 2, 0, 0] class = t 143->144 145 entropy = 0.0 samples = 1 value = [0, 0, 1, 0, 0] class = t 143->145 147 entropy = 0.0 samples = 4 value = [0, 0, 4, 0, 0] class = t 146->147 148 same_srv_rate ≤ 0.115 entropy = 0.503 samples = 27 value = [0, 3, 24, 0, 0] class = t 146->148 149 entropy = 0.811 samples = 4 value = [0, 1, 3, 0, 0] class = t 148->149 150 same_srv_rate ≤ 0.135 entropy = 0.426 samples = 23 value = [0, 2, 21, 0, 0] class = t 148->150 151 entropy = 0.0 samples = 5 value = [0, 0, 5, 0, 0] class = t 150->151 152 same_srv_rate ≤ 0.15 entropy = 0.503 samples = 18 value = [0, 2, 16, 0, 0] class = t 150->152 153 entropy = 0.811 samples = 4 value = [0, 1, 3, 0, 0] class = t 152->153 154 dst_host_serror_rate ≤ 0.015 entropy = 0.371 samples = 14 value = [0, 1, 13, 0, 0] class = t 152->154 155 entropy = 0.0 samples = 8 value = [0, 0, 8, 0, 0] class = t 154->155 156 same_srv_rate ≤ 0.185 entropy = 0.65 samples = 6 value = [0, 1, 5, 0, 0] class = t 154->156 157 entropy = 0.0 samples = 1 value = [0, 0, 1, 0, 0] class = t 156->157 158 same_srv_rate ≤ 0.21 entropy = 0.722 samples = 5 value = [0, 1, 4, 0, 0] class = t 156->158 159 entropy = 0.811 samples = 4 value = [0, 1, 3, 0, 0] class = t 158->159 160 entropy = 0.0 samples = 1 value = [0, 0, 1, 0, 0] class = t 158->160 162 entropy = 0.0 samples = 1 value = [0, 1, 0, 0, 0] class = t 161->162 163 entropy = 0.0 samples = 1 value = [0, 0, 1, 0, 0] class = t 161->163 165 same_srv_rate ≤ 0.275 entropy = 0.998 samples = 17 value = [0, 9, 8, 0, 0] class = t 164->165 176 entropy = 0.0 samples = 2 value = [0, 2, 0, 0, 0] class = t 164->176 166 dst_host_serror_rate ≤ 0.015 entropy = 0.863 samples = 7 value = [0, 5, 2, 0, 0] class = t 165->166 169 same_srv_rate ≤ 0.32 entropy = 0.971 samples = 10 value = [0, 4, 6, 0, 0] class = t 165->169 167 entropy = 0.918 samples = 6 value = [0, 4, 2, 0, 0] class = t 166->167 168 entropy = 0.0 samples = 1 value = [0, 1, 0, 0, 0] class = t 166->168 170 entropy = 0.0 samples = 2 value = [0, 0, 2, 0, 0] class = t 169->170 171 same_srv_rate ≤ 0.365 entropy = 1.0 samples = 8 value = [0, 4, 4, 0, 0] class = t 169->171 172 dst_host_serror_rate ≤ 0.015 entropy = 0.985 samples = 7 value = [0, 4, 3, 0, 0] class = t 171->172 175 entropy = 0.0 samples = 1 value = [0, 0, 1, 0, 0] class = t 171->175 173 entropy = 0.971 samples = 5 value = [0, 3, 2, 0, 0] class = t 172->173 174 entropy = 1.0 samples = 2 value = [0, 1, 1, 0, 0] class = t 172->174 178 dst_host_serror_rate ≤ 0.04 entropy = 0.153 samples = 227 value = [0, 5, 222, 0, 0] class = t 177->178 201 same_srv_rate ≤ 0.165 entropy = 0.971 samples = 5 value = [0, 2, 3, 0, 0] class = t 177->201 179 same_srv_rate ≤ 0.115 entropy = 0.379 samples = 68 value = [0, 5, 63, 0, 0] class = t 178->179 200 entropy = 0.0 samples = 159 value = [0, 0, 159, 0, 0] class = t 178->200 180 entropy = 0.0 samples = 30 value = [0, 0, 30, 0, 0] class = t 179->180 181 same_srv_rate ≤ 0.34 entropy = 0.562 samples = 38 value = [0, 5, 33, 0, 0] class = t 179->181 182 same_srv_rate ≤ 0.325 entropy = 0.592 samples = 35 value = [0, 5, 30, 0, 0] class = t 181->182 199 entropy = 0.0 samples = 3 value = [0, 0, 3, 0, 0] class = t 181->199 183 same_srv_rate ≤ 0.255 entropy = 0.533 samples = 33 value = [0, 4, 29, 0, 0] class = t 182->183 198 entropy = 1.0 samples = 2 value = [0, 1, 1, 0, 0] class = t 182->198 184 same_srv_rate ≤ 0.24 entropy = 0.634 samples = 25 value = [0, 4, 21, 0, 0] class = t 183->184 197 entropy = 0.0 samples = 8 value = [0, 0, 8, 0, 0] class = t 183->197 185 same_srv_rate ≤ 0.205 entropy = 0.559 samples = 23 value = [0, 3, 20, 0, 0] class = t 184->185 196 entropy = 1.0 samples = 2 value = [0, 1, 1, 0, 0] class = t 184->196 186 same_srv_rate ≤ 0.125 entropy = 0.629 samples = 19 value = [0, 3, 16, 0, 0] class = t 185->186 195 entropy = 0.0 samples = 4 value = [0, 0, 4, 0, 0] class = t 185->195 187 entropy = 0.811 samples = 4 value = [0, 1, 3, 0, 0] class = t 186->187 188 same_srv_rate ≤ 0.19 entropy = 0.567 samples = 15 value = [0, 2, 13, 0, 0] class = t 186->188 189 same_srv_rate ≤ 0.145 entropy = 0.439 samples = 11 value = [0, 1, 10, 0, 0] class = t 188->189 194 entropy = 0.811 samples = 4 value = [0, 1, 3, 0, 0] class = t 188->194 190 same_srv_rate ≤ 0.135 entropy = 0.65 samples = 6 value = [0, 1, 5, 0, 0] class = t 189->190 193 entropy = 0.0 samples = 5 value = [0, 0, 5, 0, 0] class = t 189->193 191 entropy = 0.0 samples = 1 value = [0, 0, 1, 0, 0] class = t 190->191 192 entropy = 0.722 samples = 5 value = [0, 1, 4, 0, 0] class = t 190->192 202 entropy = 0.0 samples = 1 value = [0, 1, 0, 0, 0] class = t 201->202 203 dst_host_serror_rate ≤ 0.185 entropy = 0.811 samples = 4 value = [0, 1, 3, 0, 0] class = t 201->203 204 entropy = 0.0 samples = 1 value = [0, 1, 0, 0, 0] class = t 203->204 205 entropy = 0.0 samples = 3 value = [0, 0, 3, 0, 0] class = t 203->205 207 dst_host_serror_rate ≤ 0.065 entropy = 0.23 samples = 161 value = [0, 155, 6, 0, 0] class = t 206->207 212 dst_host_srv_serror_rate ≤ 0.005 entropy = 0.832 samples = 121 value = [93, 1, 27, 0, 0] class = a 206->212 208 entropy = 0.0 samples = 154 value = [0, 154, 0, 0, 0] class = t 207->208 209 same_srv_rate ≤ 0.15 entropy = 0.592 samples = 7 value = [0, 1, 6, 0, 0] class = t 207->209 210 entropy = 0.0 samples = 6 value = [0, 0, 6, 0, 0] class = t 209->210 211 entropy = 0.0 samples = 1 value = [0, 1, 0, 0, 0] class = t 209->211 213 dst_host_serror_rate ≤ 0.2 entropy = 0.1 samples = 77 value = [76, 1, 0, 0, 0] class = a 212->213 216 dst_host_serror_rate ≤ 0.475 entropy = 0.962 samples = 44 value = [17, 0, 27, 0, 0] class = t 212->216 214 entropy = 0.0 samples = 76 value = [76, 0, 0, 0, 0] class = a 213->214 215 entropy = 0.0 samples = 1 value = [0, 1, 0, 0, 0] class = t 213->215 217 entropy = 0.0 samples = 26 value = [0, 0, 26, 0, 0] class = t 216->217 218 same_srv_rate ≤ 0.225 entropy = 0.31 samples = 18 value = [17, 0, 1, 0, 0] class = a 216->218 219 entropy = 0.0 samples = 17 value = [17, 0, 0, 0, 0] class = a 218->219 220 entropy = 0.0 samples = 1 value = [0, 0, 1, 0, 0] class = t 218->220 222 entropy = 0.0 samples = 19 value = [0, 19, 0, 0, 0] class = t 221->222 223 serror_rate ≤ 0.455 entropy = 0.001 samples = 26646 value = [26644, 0, 2, 0, 0] class = a 221->223 224 srv_serror_rate ≤ 0.75 entropy = 0.918 samples = 3 value = [1, 0, 2, 0, 0] class = t 223->224 227 entropy = 0.0 samples = 26643 value = [26643, 0, 0, 0, 0] class = a 223->227 225 entropy = 0.0 samples = 1 value = [1, 0, 0, 0, 0] class = a 224->225 226 entropy = 0.0 samples = 2 value = [0, 0, 2, 0, 0] class = t 224->226 229 same_srv_rate ≤ 0.945 entropy = 0.889 samples = 63470 value = [3743, 52414, 6506, 768, 39] class = t 228->229 780 dst_host_srv_serror_rate ≤ 0.105 entropy = 0.748 samples = 870 value = [746, 74, 47, 3, 0] class = a 228->780 230 same_srv_rate ≤ 0.675 entropy = 1.056 samples = 1718 value = [15, 1089, 604, 6, 4] class = t 229->230 369 dst_host_serror_rate ≤ 0.005 entropy = 0.874 samples = 61752 value = [3728, 51325, 5902, 762, 35] class = t 229->369 231 dst_host_serror_rate ≤ 0.025 entropy = 0.954 samples = 1398 value = [6, 990, 393, 6, 3] class = t 230->231 320 same_srv_rate ≤ 0.745 entropy = 1.091 samples = 320 value = [9, 99, 211, 0, 1] class = t 230->320 232 dst_host_srv_serror_rate ≤ 0.005 entropy = 0.882 samples = 1270 value = [5, 961, 295, 6, 3] class = t 231->232 281 dst_host_serror_rate ≤ 0.66 entropy = 0.835 samples = 128 value = [1, 29, 98, 0, 0] class = t 231->281 233 same_srv_rate ≤ 0.665 entropy = 0.883 samples = 1214 value = [5, 909, 294, 3, 3] class = t 232->233 270 dst_host_serror_rate ≤ 0.015 entropy = 0.429 samples = 56 value = [0, 52, 1, 3, 0] class = t 232->270 234 same_srv_rate ≤ 0.505 entropy = 0.893 samples = 1096 value = [3, 806, 282, 3, 2] class = t 233->234 265 dst_host_serror_rate ≤ 0.005 entropy = 0.665 samples = 118 value = [2, 103, 12, 0, 1] class = t 233->265 235 dst_host_serror_rate ≤ 0.005 entropy = 0.843 samples = 1043 value = [2, 797, 239, 3, 2] class = t 234->235 244 same_srv_rate ≤ 0.625 entropy = 0.787 samples = 53 value = [1, 9, 43, 0, 0] class = t 234->244 236 serror_rate ≤ 0.125 entropy = 0.819 samples = 987 value = [2, 761, 221, 1, 2] class = t 235->236 239 serror_rate ≤ 0.25 entropy = 1.108 samples = 56 value = [0, 36, 18, 2, 0] class = t 235->239 237 entropy = 0.821 samples = 983 value = [2, 757, 221, 1, 2] class = t 236->237 238 entropy = 0.0 samples = 4 value = [0, 4, 0, 0, 0] class = t 236->238 240 dst_host_serror_rate ≤ 0.015 entropy = 1.116 samples = 55 value = [0, 35, 18, 2, 0] class = t 239->240 243 entropy = 0.0 samples = 1 value = [0, 1, 0, 0, 0] class = t 239->243 241 entropy = 1.046 samples = 44 value = [0, 29, 14, 1, 0] class = t 240->241 242 entropy = 1.322 samples = 11 value = [0, 6, 4, 1, 0] class = t 240->242 245 same_srv_rate ≤ 0.545 entropy = 0.942 samples = 39 value = [1, 9, 29, 0, 0] class = t 244->245 264 entropy = 0.0 samples = 14 value = [0, 0, 14, 0, 0] class = t 244->264 246 same_srv_rate ≤ 0.525 entropy = 0.773 samples = 13 value = [1, 1, 11, 0, 0] class = t 245->246 251 same_srv_rate ≤ 0.595 entropy = 0.89 samples = 26 value = [0, 8, 18, 0, 0] class = t 245->251 247 entropy = 0.0 samples = 4 value = [0, 0, 4, 0, 0] class = t 246->247 248 same_srv_rate ≤ 0.535 entropy = 0.986 samples = 9 value = [1, 1, 7, 0, 0] class = t 246->248 249 entropy = 1.149 samples = 7 value = [1, 1, 5, 0, 0] class = t 248->249 250 entropy = 0.0 samples = 2 value = [0, 0, 2, 0, 0] class = t 248->250 252 same_srv_rate ≤ 0.575 entropy = 0.684 samples = 11 value = [0, 2, 9, 0, 0] class = t 251->252 259 same_srv_rate ≤ 0.605 entropy = 0.971 samples = 15 value = [0, 6, 9, 0, 0] class = t 251->259 253 same_srv_rate ≤ 0.555 entropy = 0.811 samples = 8 value = [0, 2, 6, 0, 0] class = t 252->253 258 entropy = 0.0 samples = 3 value = [0, 0, 3, 0, 0] class = t 252->258 254 entropy = 1.0 samples = 2 value = [0, 1, 1, 0, 0] class = t 253->254 255 same_srv_rate ≤ 0.565 entropy = 0.65 samples = 6 value = [0, 1, 5, 0, 0] class = t 253->255 256 entropy = 0.0 samples = 4 value = [0, 0, 4, 0, 0] class = t 255->256 257 entropy = 1.0 samples = 2 value = [0, 1, 1, 0, 0] class = t 255->257 260 entropy = 0.954 samples = 8 value = [0, 5, 3, 0, 0] class = t 259->260 261 same_srv_rate ≤ 0.615 entropy = 0.592 samples = 7 value = [0, 1, 6, 0, 0] class = t 259->261 262 entropy = 0.0 samples = 2 value = [0, 0, 2, 0, 0] class = t 261->262 263 entropy = 0.722 samples = 5 value = [0, 1, 4, 0, 0] class = t 261->263 266 entropy = 0.621 samples = 115 value = [2, 102, 10, 0, 1] class = t 265->266 267 dst_host_serror_rate ≤ 0.015 entropy = 0.918 samples = 3 value = [0, 1, 2, 0, 0] class = t 265->267 268 entropy = 1.0 samples = 2 value = [0, 1, 1, 0, 0] class = t 267->268 269 entropy = 0.0 samples = 1 value = [0, 0, 1, 0, 0] class = t 267->269 271 entropy = 0.0 samples = 48 value = [0, 48, 0, 0, 0] class = t 270->271 272 dst_host_srv_serror_rate ≤ 0.035 entropy = 1.406 samples = 8 value = [0, 4, 1, 3, 0] class = t 270->272 273 srv_serror_rate ≤ 0.25 entropy = 0.722 samples = 5 value = [0, 4, 0, 1, 0] class = t 272->273 278 serror_rate ≤ 0.25 entropy = 0.918 samples = 3 value = [0, 0, 1, 2, 0] class = a 272->278 274 dst_host_srv_serror_rate ≤ 0.015 entropy = 1.0 samples = 2 value = [0, 1, 0, 1, 0] class = t 273->274 277 entropy = 0.0 samples = 3 value = [0, 3, 0, 0, 0] class = t 273->277 275 entropy = 0.0 samples = 1 value = [0, 0, 0, 1, 0] class = a 274->275 276 entropy = 0.0 samples = 1 value = [0, 1, 0, 0, 0] class = t 274->276 279 entropy = 0.0 samples = 2 value = [0, 0, 0, 2, 0] class = a 278->279 280 entropy = 0.0 samples = 1 value = [0, 0, 1, 0, 0] class = t 278->280 282 dst_host_srv_serror_rate ≤ 0.035 entropy = 0.55 samples = 110 value = [0, 14, 96, 0, 0] class = t 281->282 315 srv_serror_rate ≤ 0.5 entropy = 0.803 samples = 18 value = [1, 15, 2, 0, 0] class = t 281->315 283 dst_host_serror_rate ≤ 0.205 entropy = 0.452 samples = 95 value = [0, 9, 86, 0, 0] class = t 282->283 312 dst_host_srv_serror_rate ≤ 0.89 entropy = 0.918 samples = 15 value = [0, 5, 10, 0, 0] class = t 282->312 284 dst_host_serror_rate ≤ 0.035 entropy = 0.316 samples = 70 value = [0, 4, 66, 0, 0] class = t 283->284 297 same_srv_rate ≤ 0.585 entropy = 0.722 samples = 25 value = [0, 5, 20, 0, 0] class = t 283->297 285 same_srv_rate ≤ 0.53 entropy = 0.722 samples = 15 value = [0, 3, 12, 0, 0] class = t 284->285 290 dst_host_serror_rate ≤ 0.17 entropy = 0.131 samples = 55 value = [0, 1, 54, 0, 0] class = t 284->290 286 serror_rate ≤ 0.25 entropy = 0.985 samples = 7 value = [0, 3, 4, 0, 0] class = t 285->286 289 entropy = 0.0 samples = 8 value = [0, 0, 8, 0, 0] class = t 285->289 287 entropy = 1.0 samples = 6 value = [0, 3, 3, 0, 0] class = t 286->287 288 entropy = 0.0 samples = 1 value = [0, 0, 1, 0, 0] class = t 286->288 291 entropy = 0.0 samples = 45 value = [0, 0, 45, 0, 0] class = t 290->291 292 dst_host_serror_rate ≤ 0.185 entropy = 0.469 samples = 10 value = [0, 1, 9, 0, 0] class = t 290->292 293 same_srv_rate ≤ 0.585 entropy = 0.811 samples = 4 value = [0, 1, 3, 0, 0] class = t 292->293 296 entropy = 0.0 samples = 6 value = [0, 0, 6, 0, 0] class = t 292->296 294 entropy = 0.918 samples = 3 value = [0, 1, 2, 0, 0] class = t 293->294 295 entropy = 0.0 samples = 1 value = [0, 0, 1, 0, 0] class = t 293->295 298 dst_host_serror_rate ≤ 0.4 entropy = 0.559 samples = 23 value = [0, 3, 20, 0, 0] class = t 297->298 311 entropy = 0.0 samples = 2 value = [0, 2, 0, 0, 0] class = t 297->311 299 dst_host_serror_rate ≤ 0.355 entropy = 0.61 samples = 20 value = [0, 3, 17, 0, 0] class = t 298->299 310 entropy = 0.0 samples = 3 value = [0, 0, 3, 0, 0] class = t 298->310 300 dst_host_serror_rate ≤ 0.255 entropy = 0.485 samples = 19 value = [0, 2, 17, 0, 0] class = t 299->300 309 entropy = 0.0 samples = 1 value = [0, 1, 0, 0, 0] class = t 299->309 301 dst_host_serror_rate ≤ 0.245 entropy = 0.684 samples = 11 value = [0, 2, 9, 0, 0] class = t 300->301 308 entropy = 0.0 samples = 8 value = [0, 0, 8, 0, 0] class = t 300->308 302 dst_host_serror_rate ≤ 0.225 entropy = 0.503 samples = 9 value = [0, 1, 8, 0, 0] class = t 301->302 307 entropy = 1.0 samples = 2 value = [0, 1, 1, 0, 0] class = t 301->307 303 dst_host_serror_rate ≤ 0.215 entropy = 0.811 samples = 4 value = [0, 1, 3, 0, 0] class = t 302->303 306 entropy = 0.0 samples = 5 value = [0, 0, 5, 0, 0] class = t 302->306 304 entropy = 0.0 samples = 2 value = [0, 0, 2, 0, 0] class = t 303->304 305 entropy = 1.0 samples = 2 value = [0, 1, 1, 0, 0] class = t 303->305 313 entropy = 0.0 samples = 5 value = [0, 5, 0, 0, 0] class = t 312->313 314 entropy = 0.0 samples = 10 value = [0, 0, 10, 0, 0] class = t 312->314 316 entropy = 0.0 samples = 15 value = [0, 15, 0, 0, 0] class = t 315->316 317 dst_host_srv_serror_rate ≤ 0.65 entropy = 0.918 samples = 3 value = [1, 0, 2, 0, 0] class = t 315->317 318 entropy = 0.0 samples = 1 value = [1, 0, 0, 0, 0] class = a 317->318 319 entropy = 0.0 samples = 2 value = [0, 0, 2, 0, 0] class = t 317->319 321 same_srv_rate ≤ 0.715 entropy = 0.381 samples = 54 value = [4, 0, 50, 0, 0] class = t 320->321 330 same_srv_rate ≤ 0.835 entropy = 1.107 samples = 266 value = [5, 99, 161, 0, 1] class = t 320->330 322 entropy = 0.0 samples = 28 value = [0, 0, 28, 0, 0] class = t 321->322 323 dst_host_serror_rate ≤ 0.01 entropy = 0.619 samples = 26 value = [4, 0, 22, 0, 0] class = t 321->323 324 same_srv_rate ≤ 0.735 entropy = 0.742 samples = 19 value = [4, 0, 15, 0, 0] class = t 323->324 329 entropy = 0.0 samples = 7 value = [0, 0, 7, 0, 0] class = t 323->329 325 same_srv_rate ≤ 0.725 entropy = 0.845 samples = 11 value = [3, 0, 8, 0, 0] class = t 324->325 328 entropy = 0.544 samples = 8 value = [1, 0, 7, 0, 0] class = t 324->328 326 entropy = 0.65 samples = 6 value = [1, 0, 5, 0, 0] class = t 325->326 327 entropy = 0.971 samples = 5 value = [2, 0, 3, 0, 0] class = t 325->327 331 dst_host_serror_rate ≤ 0.015 entropy = 1.307 samples = 93 value = [5, 50, 37, 0, 1] class = t 330->331 346 dst_host_serror_rate ≤ 0.045 entropy = 0.86 samples = 173 value = [0, 49, 124, 0, 0] class = t 330->346 332 same_srv_rate ≤ 0.785 entropy = 1.235 samples = 75 value = [5, 50, 19, 0, 1] class = t 331->332 345 entropy = 0.0 samples = 18 value = [0, 0, 18, 0, 0] class = t 331->345 333 same_srv_rate ≤ 0.755 entropy = 1.437 samples = 31 value = [2, 16, 12, 0, 1] class = t 332->333 338 same_srv_rate ≤ 0.81 entropy = 0.974 samples = 44 value = [3, 34, 7, 0, 0] class = t 332->338 334 entropy = 1.454 samples = 27 value = [2, 15, 9, 0, 1] class = t 333->334 335 same_srv_rate ≤ 0.77 entropy = 0.811 samples = 4 value = [0, 1, 3, 0, 0] class = t 333->335 336 entropy = 0.0 samples = 2 value = [0, 0, 2, 0, 0] class = t 335->336 337 entropy = 1.0 samples = 2 value = [0, 1, 1, 0, 0] class = t 335->337 339 serror_rate ≤ 0.035 entropy = 0.857 samples = 21 value = [3, 17, 1, 0, 0] class = t 338->339 342 same_srv_rate ≤ 0.825 entropy = 0.828 samples = 23 value = [0, 17, 6, 0, 0] class = t 338->342 340 entropy = 0.884 samples = 20 value = [3, 16, 1, 0, 0] class = t 339->340 341 entropy = 0.0 samples = 1 value = [0, 1, 0, 0, 0] class = t 339->341 343 entropy = 1.0 samples = 2 value = [0, 1, 1, 0, 0] class = t 342->343 344 entropy = 0.792 samples = 21 value = [0, 16, 5, 0, 0] class = t 342->344 347 dst_host_serror_rate ≤ 0.005 entropy = 0.896 samples = 157 value = [0, 49, 108, 0, 0] class = t 346->347 368 entropy = 0.0 samples = 16 value = [0, 0, 16, 0, 0] class = t 346->368 348 same_srv_rate ≤ 0.855 entropy = 0.868 samples = 152 value = [0, 44, 108, 0, 0] class = t 347->348 367 entropy = 0.0 samples = 5 value = [0, 5, 0, 0, 0] class = t 347->367 349 entropy = 0.0 samples = 14 value = [0, 0, 14, 0, 0] class = t 348->349 350 same_srv_rate ≤ 0.865 entropy = 0.903 samples = 138 value = [0, 44, 94, 0, 0] class = t 348->350 351 entropy = 0.98 samples = 24 value = [0, 14, 10, 0, 0] class = t 350->351 352 same_srv_rate ≤ 0.875 entropy = 0.831 samples = 114 value = [0, 30, 84, 0, 0] class = t 350->352 353 entropy = 0.0 samples = 11 value = [0, 0, 11, 0, 0] class = t 352->353 354 same_srv_rate ≤ 0.935 entropy = 0.87 samples = 103 value = [0, 30, 73, 0, 0] class = t 352->354 355 same_srv_rate ≤ 0.905 entropy = 0.828 samples = 92 value = [0, 24, 68, 0, 0] class = t 354->355 366 entropy = 0.994 samples = 11 value = [0, 6, 5, 0, 0] class = t 354->366 356 same_srv_rate ≤ 0.895 entropy = 0.946 samples = 33 value = [0, 12, 21, 0, 0] class = t 355->356 361 same_srv_rate ≤ 0.915 entropy = 0.729 samples = 59 value = [0, 12, 47, 0, 0] class = t 355->361 357 same_srv_rate ≤ 0.885 entropy = 0.954 samples = 24 value = [0, 9, 15, 0, 0] class = t 356->357 360 entropy = 0.918 samples = 9 value = [0, 3, 6, 0, 0] class = t 356->360 358 entropy = 0.937 samples = 17 value = [0, 6, 11, 0, 0] class = t 357->358 359 entropy = 0.985 samples = 7 value = [0, 3, 4, 0, 0] class = t 357->359 362 entropy = 0.337 samples = 16 value = [0, 1, 15, 0, 0] class = t 361->362 363 same_srv_rate ≤ 0.925 entropy = 0.82 samples = 43 value = [0, 11, 32, 0, 0] class = t 361->363 364 entropy = 0.706 samples = 26 value = [0, 5, 21, 0, 0] class = t 363->364 365 entropy = 0.937 samples = 17 value = [0, 6, 11, 0, 0] class = t 363->365 370 dst_host_srv_serror_rate ≤ 0.005 entropy = 0.847 samples = 56081 value = [2982, 46916, 5547, 601, 35] class = t 369->370 435 dst_host_srv_serror_rate ≤ 0.99 entropy = 1.063 samples = 5671 value = [746, 4409, 355, 161, 0] class = t 369->435 371 same_srv_rate ≤ 0.995 entropy = 0.862 samples = 54206 value = [2982, 45090, 5545, 555, 34] class = t 370->371 408 dst_host_srv_serror_rate ≤ 0.015 entropy = 0.185 samples = 1875 value = [0, 1826, 2, 46, 1] class = t 370->408 372 serror_rate ≤ 0.005 entropy = 0.523 samples = 746 value = [88, 658, 0, 0, 0] class = t 371->372 383 srv_serror_rate ≤ 0.005 entropy = 0.864 samples = 53460 value = [2894, 44432, 5545, 555, 34] class = t 371->383 373 same_srv_rate ≤ 0.985 entropy = 0.289 samples = 693 value = [35, 658, 0, 0, 0] class = t 372->373 382 entropy = 0.0 samples = 53 value = [53, 0, 0, 0, 0] class = a 372->382 374 same_srv_rate ≤ 0.955 entropy = 0.89 samples = 104 value = [32, 72, 0, 0, 0] class = t 373->374 381 entropy = 0.046 samples = 589 value = [3, 586, 0, 0, 0] class = t 373->381 375 entropy = 0.722 samples = 5 value = [1, 4, 0, 0, 0] class = t 374->375 376 same_srv_rate ≤ 0.965 entropy = 0.897 samples = 99 value = [31, 68, 0, 0, 0] class = t 374->376 377 entropy = 0.845 samples = 11 value = [3, 8, 0, 0, 0] class = t 376->377 378 same_srv_rate ≤ 0.975 entropy = 0.902 samples = 88 value = [28, 60, 0, 0, 0] class = t 376->378 379 entropy = 0.896 samples = 32 value = [10, 22, 0, 0, 0] class = t 378->379 380 entropy = 0.906 samples = 56 value = [18, 38, 0, 0, 0] class = t 378->380 384 entropy = 0.871 samples = 52818 value = [2888, 43796, 5545, 555, 34] class = t 383->384 385 serror_rate ≤ 0.155 entropy = 0.076 samples = 642 value = [6, 636, 0, 0, 0] class = t 383->385 386 entropy = 0.0 samples = 369 value = [0, 369, 0, 0, 0] class = t 385->386 387 srv_serror_rate ≤ 0.16 entropy = 0.152 samples = 273 value = [6, 267, 0, 0, 0] class = t 385->387 388 entropy = 0.0 samples = 25 value = [0, 25, 0, 0, 0] class = t 387->388 389 serror_rate ≤ 0.75 entropy = 0.164 samples = 248 value = [6, 242, 0, 0, 0] class = t 387->389 390 srv_serror_rate ≤ 0.45 entropy = 0.177 samples = 226 value = [6, 220, 0, 0, 0] class = t 389->390 407 entropy = 0.0 samples = 22 value = [0, 22, 0, 0, 0] class = t 389->407 391 serror_rate ≤ 0.29 entropy = 0.147 samples = 190 value = [4, 186, 0, 0, 0] class = t 390->391 404 serror_rate ≤ 0.415 entropy = 0.31 samples = 36 value = [2, 34, 0, 0, 0] class = t 390->404 392 srv_serror_rate ≤ 0.235 entropy = 0.204 samples = 125 value = [4, 121, 0, 0, 0] class = t 391->392 403 entropy = 0.0 samples = 65 value = [0, 65, 0, 0, 0] class = t 391->403 393 serror_rate ≤ 0.21 entropy = 0.165 samples = 82 value = [2, 80, 0, 0, 0] class = t 392->393 400 serror_rate ≤ 0.225 entropy = 0.271 samples = 43 value = [2, 41, 0, 0, 0] class = t 392->400 394 srv_serror_rate ≤ 0.175 entropy = 0.174 samples = 77 value = [2, 75, 0, 0, 0] class = t 393->394 399 entropy = 0.0 samples = 5 value = [0, 5, 0, 0, 0] class = t 393->399 395 entropy = 0.196 samples = 33 value = [1, 32, 0, 0, 0] class = t 394->395 396 serror_rate ≤ 0.19 entropy = 0.156 samples = 44 value = [1, 43, 0, 0, 0] class = t 394->396 397 entropy = 0.0 samples = 1 value = [0, 1, 0, 0, 0] class = t 396->397 398 entropy = 0.159 samples = 43 value = [1, 42, 0, 0, 0] class = t 396->398 401 entropy = 0.0 samples = 1 value = [0, 1, 0, 0, 0] class = t 400->401 402 entropy = 0.276 samples = 42 value = [2, 40, 0, 0, 0] class = t 400->402 405 entropy = 0.0 samples = 1 value = [0, 1, 0, 0, 0] class = t 404->405 406 entropy = 0.316 samples = 35 value = [2, 33, 0, 0, 0] class = t 404->406 409 srv_serror_rate ≤ 0.015 entropy = 0.008 samples = 1451 value = [0, 1450, 1, 0, 0] class = t 408->409 414 dst_host_srv_serror_rate ≤ 0.045 entropy = 0.543 samples = 424 value = [0, 376, 1, 46, 1] class = t 408->414 410 same_srv_rate ≤ 0.975 entropy = 0.008 samples = 1413 value = [0, 1412, 1, 0, 0] class = t 409->410 413 entropy = 0.0 samples = 38 value = [0, 38, 0, 0, 0] class = t 409->413 411 entropy = 0.0 samples = 1 value = [0, 1, 0, 0, 0] class = t 410->411 412 entropy = 0.008 samples = 1412 value = [0, 1411, 1, 0, 0] class = t 410->412 415 dst_host_srv_serror_rate ≤ 0.025 entropy = 0.667 samples = 264 value = [0, 218, 0, 46, 0] class = t 414->415 426 dst_host_srv_serror_rate ≤ 0.075 entropy = 0.109 samples = 160 value = [0, 158, 1, 0, 1] class = t 414->426 416 serror_rate ≤ 0.165 entropy = 0.558 samples = 192 value = [0, 167, 0, 25, 0] class = t 415->416 421 dst_host_srv_serror_rate ≤ 0.035 entropy = 0.871 samples = 72 value = [0, 51, 0, 21, 0] class = t 415->421 417 srv_serror_rate ≤ 0.07 entropy = 0.564 samples = 189 value = [0, 164, 0, 25, 0] class = t 416->417 420 entropy = 0.0 samples = 3 value = [0, 3, 0, 0, 0] class = t 416->420 418 entropy = 0.551 samples = 188 value = [0, 164, 0, 24, 0] class = t 417->418 419 entropy = 0.0 samples = 1 value = [0, 0, 0, 1, 0] class = a 417->419 422 entropy = 0.982 samples = 38 value = [0, 22, 0, 16, 0] class = t 421->422 423 srv_serror_rate ≤ 0.25 entropy = 0.602 samples = 34 value = [0, 29, 0, 5, 0] class = t 421->423 424 entropy = 0.614 samples = 33 value = [0, 28, 0, 5, 0] class = t 423->424 425 entropy = 0.0 samples = 1 value = [0, 1, 0, 0, 0] class = t 423->425 427 dst_host_srv_serror_rate ≤ 0.065 entropy = 0.235 samples = 26 value = [0, 25, 1, 0, 0] class = t 426->427 430 dst_host_srv_serror_rate ≤ 0.245 entropy = 0.063 samples = 134 value = [0, 133, 0, 0, 1] class = t 426->430 428 entropy = 0.0 samples = 8 value = [0, 8, 0, 0, 0] class = t 427->428 429 entropy = 0.31 samples = 18 value = [0, 17, 1, 0, 0] class = t 427->429 431 entropy = 0.0 samples = 103 value = [0, 103, 0, 0, 0] class = t 430->431 432 dst_host_srv_serror_rate ≤ 0.26 entropy = 0.206 samples = 31 value = [0, 30, 0, 0, 1] class = t 430->432 433 entropy = 0.65 samples = 6 value = [0, 5, 0, 0, 1] class = t 432->433 434 entropy = 0.0 samples = 25 value = [0, 25, 0, 0, 0] class = t 432->434 436 dst_host_srv_serror_rate ≤ 0.005 entropy = 0.976 samples = 5504 value = [732, 4398, 213, 161, 0] class = t 435->436 739 dst_host_serror_rate ≤ 0.045 entropy = 0.757 samples = 167 value = [14, 11, 142, 0, 0] class = t 435->739 437 srv_serror_rate ≤ 0.005 entropy = 1.248 samples = 2926 value = [582, 2047, 210, 87, 0] class = t 436->437 546 dst_host_serror_rate ≤ 0.845 entropy = 0.518 samples = 2578 value = [150, 2351, 3, 74, 0] class = t 436->546 438 dst_host_serror_rate ≤ 0.395 entropy = 1.347 samples = 2556 value = [582, 1677, 210, 87, 0] class = t 437->438 545 entropy = 0.0 samples = 370 value = [0, 370, 0, 0, 0] class = t 437->545 439 dst_host_serror_rate ≤ 0.025 entropy = 1.462 samples = 2133 value = [555, 1283, 208, 87, 0] class = t 438->439 516 dst_host_serror_rate ≤ 0.615 entropy = 0.385 samples = 423 value = [27, 394, 2, 0, 0] class = t 438->516 440 dst_host_serror_rate ≤ 0.015 entropy = 1.129 samples = 1379 value = [351, 959, 23, 46, 0] class = t 439->440 443 dst_host_serror_rate ≤ 0.085 entropy = 1.76 samples = 754 value = [204, 324, 185, 41, 0] class = t 439->443 441 entropy = 0.948 samples = 974 value = [170, 763, 15, 26, 0] class = t 440->441 442 entropy = 1.352 samples = 405 value = [181, 196, 8, 20, 0] class = t 440->442 444 dst_host_serror_rate ≤ 0.035 entropy = 1.579 samples = 363 value = [44, 164, 143, 12, 0] class = t 443->444 455 dst_host_serror_rate ≤ 0.225 entropy = 1.679 samples = 391 value = [160, 160, 42, 29, 0] class = a 443->455 445 entropy = 1.485 samples = 156 value = [21, 82, 51, 2, 0] class = t 444->445 446 dst_host_serror_rate ≤ 0.065 entropy = 1.613 samples = 207 value = [23, 82, 92, 10, 0] class = t 444->446 447 dst_host_serror_rate ≤ 0.055 entropy = 1.545 samples = 158 value = [14, 60, 77, 7, 0] class = t 446->447 452 dst_host_serror_rate ≤ 0.075 entropy = 1.737 samples = 49 value = [9, 22, 15, 3, 0] class = t 446->452 448 dst_host_serror_rate ≤ 0.045 entropy = 1.533 samples = 122 value = [11, 45, 61, 5, 0] class = t 447->448 451 entropy = 1.577 samples = 36 value = [3, 15, 16, 2, 0] class = t 447->451 449 entropy = 1.498 samples = 69 value = [5, 26, 35, 3, 0] class = t 448->449 450 entropy = 1.569 samples = 53 value = [6, 19, 26, 2, 0] class = t 448->450 453 entropy = 1.787 samples = 29 value = [6, 12, 9, 2, 0] class = t 452->453 454 entropy = 1.648 samples = 20 value = [3, 10, 6, 1, 0] class = t 452->454 456 dst_host_serror_rate ≤ 0.095 entropy = 1.761 samples = 235 value = [120, 46, 41, 28, 0] class = a 455->456 483 dst_host_serror_rate ≤ 0.385 entropy = 0.928 samples = 156 value = [40, 114, 1, 1, 0] class = t 455->483 457 entropy = 0.865 samples = 83 value = [70, 4, 6, 3, 0] class = a 456->457 458 dst_host_serror_rate ≤ 0.165 entropy = 1.957 samples = 152 value = [50, 42, 35, 25, 0] class = a 456->458 459 dst_host_serror_rate ≤ 0.125 entropy = 1.946 samples = 108 value = [26, 35, 31, 16, 0] class = t 458->459 472 dst_host_serror_rate ≤ 0.205 entropy = 1.682 samples = 44 value = [24, 7, 4, 9, 0] class = a 458->472 460 dst_host_serror_rate ≤ 0.105 entropy = 1.833 samples = 51 value = [10, 23, 12, 6, 0] class = t 459->460 465 dst_host_serror_rate ≤ 0.135 entropy = 1.957 samples = 57 value = [16, 12, 19, 10, 0] class = t 459->465 461 entropy = 1.706 samples = 15 value = [1, 6, 6, 2, 0] class = t 460->461 462 dst_host_serror_rate ≤ 0.115 entropy = 1.794 samples = 36 value = [9, 17, 6, 4, 0] class = t 460->462 463 entropy = 1.718 samples = 22 value = [6, 11, 3, 2, 0] class = t 462->463 464 entropy = 1.877 samples = 14 value = [3, 6, 3, 2, 0] class = t 462->464 466 entropy = 1.706 samples = 21 value = [5, 2, 11, 3, 0] class = t 465->466 467 dst_host_serror_rate ≤ 0.155 entropy = 1.978 samples = 36 value = [11, 10, 8, 7, 0] class = a 465->467 468 dst_host_serror_rate ≤ 0.145 entropy = 1.561 samples = 16 value = [6, 6, 0, 4, 0] class = a 467->468 471 entropy = 1.904 samples = 20 value = [5, 4, 8, 3, 0] class = t 467->471 469 entropy = 1.561 samples = 8 value = [3, 3, 0, 2, 0] class = a 468->469 470 entropy = 1.561 samples = 8 value = [3, 3, 0, 2, 0] class = a 468->470 473 dst_host_serror_rate ≤ 0.175 entropy = 1.537 samples = 35 value = [20, 7, 1, 7, 0] class = a 472->473 480 dst_host_serror_rate ≤ 0.215 entropy = 1.53 samples = 9 value = [4, 0, 3, 2, 0] class = a 472->480 474 entropy = 1.75 samples = 8 value = [4, 2, 1, 1, 0] class = a 473->474 475 dst_host_serror_rate ≤ 0.195 entropy = 1.38 samples = 27 value = [16, 5, 0, 6, 0] class = a 473->475 476 dst_host_serror_rate ≤ 0.185 entropy = 1.53 samples = 15 value = [7, 4, 0, 4, 0] class = a 475->476 479 entropy = 1.041 samples = 12 value = [9, 1, 0, 2, 0] class = a 475->479 477 entropy = 1.5 samples = 8 value = [4, 2, 0, 2, 0] class = a 476->477 478 entropy = 1.557 samples = 7 value = [3, 2, 0, 2, 0] class = a 476->478 481 entropy = 1.522 samples = 5 value = [2, 0, 2, 1, 0] class = a 480->481 482 entropy = 1.5 samples = 4 value = [2, 0, 1, 1, 0] class = a 480->482 484 dst_host_serror_rate ≤ 0.285 entropy = 0.885 samples = 149 value = [39, 109, 1, 0, 0] class = t 483->484 515 entropy = 1.149 samples = 7 value = [1, 5, 0, 1, 0] class = t 483->515 485 dst_host_serror_rate ≤ 0.245 entropy = 0.868 samples = 64 value = [14, 49, 1, 0, 0] class = t 484->485 496 dst_host_serror_rate ≤ 0.305 entropy = 0.874 samples = 85 value = [25, 60, 0, 0, 0] class = t 484->496 486 dst_host_serror_rate ≤ 0.235 entropy = 0.918 samples = 15 value = [5, 10, 0, 0, 0] class = t 485->486 489 dst_host_serror_rate ≤ 0.255 entropy = 0.826 samples = 49 value = [9, 39, 1, 0, 0] class = t 485->489 487 entropy = 0.971 samples = 5 value = [2, 3, 0, 0, 0] class = t 486->487 488 entropy = 0.881 samples = 10 value = [3, 7, 0, 0, 0] class = t 486->488 490 entropy = 0.922 samples = 30 value = [6, 23, 1, 0, 0] class = t 489->490 491 dst_host_serror_rate ≤ 0.275 entropy = 0.629 samples = 19 value = [3, 16, 0, 0, 0] class = t 489->491 492 dst_host_serror_rate ≤ 0.265 entropy = 0.592 samples = 14 value = [2, 12, 0, 0, 0] class = t 491->492 495 entropy = 0.722 samples = 5 value = [1, 4, 0, 0, 0] class = t 491->495 493 entropy = 0.592 samples = 7 value = [1, 6, 0, 0, 0] class = t 492->493 494 entropy = 0.592 samples = 7 value = [1, 6, 0, 0, 0] class = t 492->494 497 dst_host_serror_rate ≤ 0.295 entropy = 0.994 samples = 11 value = [5, 6, 0, 0, 0] class = t 496->497 500 dst_host_serror_rate ≤ 0.335 entropy = 0.842 samples = 74 value = [20, 54, 0, 0, 0] class = t 496->500 498 entropy = 0.985 samples = 7 value = [3, 4, 0, 0, 0] class = t 497->498 499 entropy = 1.0 samples = 4 value = [2, 2, 0, 0, 0] class = a 497->499 501 dst_host_serror_rate ≤ 0.325 entropy = 0.759 samples = 41 value = [9, 32, 0, 0, 0] class = t 500->501 506 dst_host_serror_rate ≤ 0.365 entropy = 0.918 samples = 33 value = [11, 22, 0, 0, 0] class = t 500->506 502 dst_host_serror_rate ≤ 0.315 entropy = 0.89 samples = 13 value = [4, 9, 0, 0, 0] class = t 501->502 505 entropy = 0.677 samples = 28 value = [5, 23, 0, 0, 0] class = t 501->505 503 entropy = 0.918 samples = 9 value = [3, 6, 0, 0, 0] class = t 502->503 504 entropy = 0.811 samples = 4 value = [1, 3, 0, 0, 0] class = t 502->504 507 dst_host_serror_rate ≤ 0.355 entropy = 0.954 samples = 16 value = [6, 10, 0, 0, 0] class = t 506->507 512 dst_host_serror_rate ≤ 0.375 entropy = 0.874 samples = 17 value = [5, 12, 0, 0, 0] class = t 506->512 508 dst_host_serror_rate ≤ 0.345 entropy = 0.881 samples = 10 value = [3, 7, 0, 0, 0] class = t 507->508 511 entropy = 1.0 samples = 6 value = [3, 3, 0, 0, 0] class = a 507->511 509 entropy = 0.918 samples = 3 value = [1, 2, 0, 0, 0] class = t 508->509 510 entropy = 0.863 samples = 7 value = [2, 5, 0, 0, 0] class = t 508->510 513 entropy = 0.863 samples = 7 value = [2, 5, 0, 0, 0] class = t 512->513 514 entropy = 0.881 samples = 10 value = [3, 7, 0, 0, 0] class = t 512->514 517 dst_host_serror_rate ≤ 0.495 entropy = 0.681 samples = 186 value = [27, 157, 2, 0, 0] class = t 516->517 544 entropy = 0.0 samples = 237 value = [0, 237, 0, 0, 0] class = t 516->544 518 dst_host_serror_rate ≤ 0.415 entropy = 0.235 samples = 78 value = [3, 75, 0, 0, 0] class = t 517->518 523 dst_host_serror_rate ≤ 0.535 entropy = 0.89 samples = 108 value = [24, 82, 2, 0, 0] class = t 517->523 519 dst_host_serror_rate ≤ 0.405 entropy = 0.696 samples = 16 value = [3, 13, 0, 0, 0] class = t 518->519 522 entropy = 0.0 samples = 62 value = [0, 62, 0, 0, 0] class = t 518->522 520 entropy = 0.684 samples = 11 value = [2, 9, 0, 0, 0] class = t 519->520 521 entropy = 0.722 samples = 5 value = [1, 4, 0, 0, 0] class = t 519->521 524 dst_host_serror_rate ≤ 0.505 entropy = 0.819 samples = 45 value = [6, 37, 2, 0, 0] class = t 523->524 529 dst_host_serror_rate ≤ 0.545 entropy = 0.863 samples = 63 value = [18, 45, 0, 0, 0] class = t 523->529 525 entropy = 0.918 samples = 15 value = [5, 10, 0, 0, 0] class = t 524->525 526 dst_host_serror_rate ≤ 0.525 entropy = 0.561 samples = 30 value = [1, 27, 2, 0, 0] class = t 524->526 527 entropy = 0.0 samples = 15 value = [0, 15, 0, 0, 0] class = t 526->527 528 entropy = 0.906 samples = 15 value = [1, 12, 2, 0, 0] class = t 526->528 530 entropy = 0.722 samples = 5 value = [1, 4, 0, 0, 0] class = t 529->530 531 dst_host_serror_rate ≤ 0.605 entropy = 0.873 samples = 58 value = [17, 41, 0, 0, 0] class = t 529->531 532 dst_host_serror_rate ≤ 0.575 entropy = 0.884 samples = 53 value = [16, 37, 0, 0, 0] class = t 531->532 543 entropy = 0.722 samples = 5 value = [1, 4, 0, 0, 0] class = t 531->543 533 dst_host_serror_rate ≤ 0.565 entropy = 0.85 samples = 29 value = [8, 21, 0, 0, 0] class = t 532->533 538 dst_host_serror_rate ≤ 0.585 entropy = 0.918 samples = 24 value = [8, 16, 0, 0, 0] class = t 532->538 534 dst_host_serror_rate ≤ 0.555 entropy = 0.863 samples = 21 value = [6, 15, 0, 0, 0] class = t 533->534 537 entropy = 0.811 samples = 8 value = [2, 6, 0, 0, 0] class = t 533->537 535 entropy = 0.845 samples = 11 value = [3, 8, 0, 0, 0] class = t 534->535 536 entropy = 0.881 samples = 10 value = [3, 7, 0, 0, 0] class = t 534->536 539 entropy = 0.985 samples = 7 value = [3, 4, 0, 0, 0] class = t 538->539 540 dst_host_serror_rate ≤ 0.595 entropy = 0.874 samples = 17 value = [5, 12, 0, 0, 0] class = t 538->540 541 entropy = 0.863 samples = 7 value = [2, 5, 0, 0, 0] class = t 540->541 542 entropy = 0.881 samples = 10 value = [3, 7, 0, 0, 0] class = t 540->542 547 dst_host_serror_rate ≤ 0.035 entropy = 0.467 samples = 2501 value = [114, 2311, 2, 74, 0] class = t 546->547 726 serror_rate ≤ 0.5 entropy = 1.085 samples = 77 value = [36, 40, 1, 0, 0] class = t 546->726 548 serror_rate ≤ 0.01 entropy = 0.402 samples = 1747 value = [105, 1626, 0, 16, 0] class = t 547->548 617 dst_host_srv_serror_rate ≤ 0.015 entropy = 0.509 samples = 754 value = [9, 685, 2, 58, 0] class = t 547->617 549 dst_host_srv_serror_rate ≤ 0.035 entropy = 0.472 samples = 1332 value = [98, 1218, 0, 16, 0] class = t 548->549 586 dst_host_serror_rate ≤ 0.025 entropy = 0.123 samples = 415 value = [7, 408, 0, 0, 0] class = t 548->586 550 dst_host_serror_rate ≤ 0.015 entropy = 0.491 samples = 1190 value = [98, 1080, 0, 12, 0] class = t 549->550 573 dst_host_srv_serror_rate ≤ 0.055 entropy = 0.185 samples = 142 value = [0, 138, 0, 4, 0] class = t 549->573 551 dst_host_srv_serror_rate ≤ 0.015 entropy = 0.462 samples = 924 value = [77, 842, 0, 5, 0] class = t 550->551 558 dst_host_srv_serror_rate ≤ 0.015 entropy = 0.571 samples = 266 value = [21, 238, 0, 7, 0] class = t 550->558 552 srv_serror_rate ≤ 0.02 entropy = 0.495 samples = 815 value = [77, 734, 0, 4, 0] class = t 551->552 555 dst_host_srv_serror_rate ≤ 0.025 entropy = 0.075 samples = 109 value = [0, 108, 0, 1, 0] class = t 551->555 553 entropy = 0.5 samples = 803 value = [77, 722, 0, 4, 0] class = t 552->553 554 entropy = 0.0 samples = 12 value = [0, 12, 0, 0, 0] class = t 552->554 556 entropy = 0.0 samples = 95 value = [0, 95, 0, 0, 0] class = t 555->556 557 entropy = 0.371 samples = 14 value = [0, 13, 0, 1, 0] class = t 555->557 559 dst_host_serror_rate ≤ 0.025 entropy = 0.147 samples = 143 value = [0, 140, 0, 3, 0] class = t 558->559 564 srv_serror_rate ≤ 0.125 entropy = 0.857 samples = 123 value = [21, 98, 0, 4, 0] class = t 558->564 560 srv_serror_rate ≤ 0.125 entropy = 0.197 samples = 98 value = [0, 95, 0, 3, 0] class = t 559->560 563 entropy = 0.0 samples = 45 value = [0, 45, 0, 0, 0] class = t 559->563 561 entropy = 0.201 samples = 96 value = [0, 93, 0, 3, 0] class = t 560->561 562 entropy = 0.0 samples = 2 value = [0, 2, 0, 0, 0] class = t 560->562 565 dst_host_serror_rate ≤ 0.025 entropy = 0.828 samples = 121 value = [19, 98, 0, 4, 0] class = t 564->565 572 entropy = 0.0 samples = 2 value = [2, 0, 0, 0, 0] class = a 564->572 566 dst_host_srv_serror_rate ≤ 0.025 entropy = 0.913 samples = 88 value = [15, 69, 0, 4, 0] class = t 565->566 569 dst_host_srv_serror_rate ≤ 0.025 entropy = 0.533 samples = 33 value = [4, 29, 0, 0, 0] class = t 565->569 567 entropy = 1.02 samples = 73 value = [15, 54, 0, 4, 0] class = t 566->567 568 entropy = 0.0 samples = 15 value = [0, 15, 0, 0, 0] class = t 566->568 570 entropy = 0.0 samples = 16 value = [0, 16, 0, 0, 0] class = t 569->570 571 entropy = 0.787 samples = 17 value = [4, 13, 0, 0, 0] class = t 569->571 574 dst_host_serror_rate ≤ 0.025 entropy = 0.433 samples = 45 value = [0, 41, 0, 4, 0] class = t 573->574 585 entropy = 0.0 samples = 97 value = [0, 97, 0, 0, 0] class = t 573->585 575 dst_host_serror_rate ≤ 0.015 entropy = 0.454 samples = 42 value = [0, 38, 0, 4, 0] class = t 574->575 584 entropy = 0.0 samples = 3 value = [0, 3, 0, 0, 0] class = t 574->584 576 dst_host_srv_serror_rate ≤ 0.045 entropy = 0.371 samples = 28 value = [0, 26, 0, 2, 0] class = t 575->576 579 dst_host_srv_serror_rate ≤ 0.045 entropy = 0.592 samples = 14 value = [0, 12, 0, 2, 0] class = t 575->579 577 entropy = 0.544 samples = 16 value = [0, 14, 0, 2, 0] class = t 576->577 578 entropy = 0.0 samples = 12 value = [0, 12, 0, 0, 0] class = t 576->578 580 entropy = 0.0 samples = 6 value = [0, 6, 0, 0, 0] class = t 579->580 581 srv_serror_rate ≤ 0.04 entropy = 0.811 samples = 8 value = [0, 6, 0, 2, 0] class = t 579->581 582 entropy = 0.863 samples = 7 value = [0, 5, 0, 2, 0] class = t 581->582 583 entropy = 0.0 samples = 1 value = [0, 1, 0, 0, 0] class = t 581->583 587 srv_serror_rate ≤ 0.19 entropy = 0.087 samples = 365 value = [4, 361, 0, 0, 0] class = t 586->587 612 serror_rate ≤ 0.225 entropy = 0.327 samples = 50 value = [3, 47, 0, 0, 0] class = t 586->612 588 entropy = 0.0 samples = 96 value = [0, 96, 0, 0, 0] class = t 587->588 589 serror_rate ≤ 0.75 entropy = 0.112 samples = 269 value = [4, 265, 0, 0, 0] class = t 587->589 590 srv_serror_rate ≤ 0.465 entropy = 0.15 samples = 186 value = [4, 182, 0, 0, 0] class = t 589->590 611 entropy = 0.0 samples = 83 value = [0, 83, 0, 0, 0] class = t 589->611 591 serror_rate ≤ 0.21 entropy = 0.072 samples = 115 value = [1, 114, 0, 0, 0] class = t 590->591 602 dst_host_srv_serror_rate ≤ 0.015 entropy = 0.253 samples = 71 value = [3, 68, 0, 0, 0] class = t 590->602 592 srv_serror_rate ≤ 0.21 entropy = 0.286 samples = 20 value = [1, 19, 0, 0, 0] class = t 591->592 601 entropy = 0.0 samples = 95 value = [0, 95, 0, 0, 0] class = t 591->601 593 dst_host_srv_serror_rate ≤ 0.015 entropy = 0.371 samples = 14 value = [1, 13, 0, 0, 0] class = t 592->593 600 entropy = 0.0 samples = 6 value = [0, 6, 0, 0, 0] class = t 592->600 594 serror_rate ≤ 0.17 entropy = 0.414 samples = 12 value = [1, 11, 0, 0, 0] class = t 593->594 599 entropy = 0.0 samples = 2 value = [0, 2, 0, 0, 0] class = t 593->599 595 entropy = 0.0 samples = 1 value = [0, 1, 0, 0, 0] class = t 594->595 596 dst_host_serror_rate ≤ 0.015 entropy = 0.439 samples = 11 value = [1, 10, 0, 0, 0] class = t 594->596 597 entropy = 0.469 samples = 10 value = [1, 9, 0, 0, 0] class = t 596->597 598 entropy = 0.0 samples = 1 value = [0, 1, 0, 0, 0] class = t 596->598 603 dst_host_serror_rate ≤ 0.015 entropy = 0.332 samples = 49 value = [3, 46, 0, 0, 0] class = t 602->603 610 entropy = 0.0 samples = 22 value = [0, 22, 0, 0, 0] class = t 602->610 604 srv_serror_rate ≤ 0.585 entropy = 0.348 samples = 46 value = [3, 43, 0, 0, 0] class = t 603->604 609 entropy = 0.0 samples = 3 value = [0, 3, 0, 0, 0] class = t 603->609 605 serror_rate ≤ 0.415 entropy = 0.353 samples = 45 value = [3, 42, 0, 0, 0] class = t 604->605 608 entropy = 0.0 samples = 1 value = [0, 1, 0, 0, 0] class = t 604->608 606 entropy = 0.0 samples = 1 value = [0, 1, 0, 0, 0] class = t 605->606 607 entropy = 0.359 samples = 44 value = [3, 41, 0, 0, 0] class = t 605->607 613 srv_serror_rate ≤ 0.13 entropy = 0.918 samples = 9 value = [3, 6, 0, 0, 0] class = t 612->613 616 entropy = 0.0 samples = 41 value = [0, 41, 0, 0, 0] class = t 612->616 614 entropy = 0.0 samples = 6 value = [0, 6, 0, 0, 0] class = t 613->614 615 entropy = 0.0 samples = 3 value = [3, 0, 0, 0, 0] class = a 613->615 618 entropy = 0.0 samples = 238 value = [0, 238, 0, 0, 0] class = t 617->618 619 dst_host_srv_serror_rate ≤ 0.085 entropy = 0.667 samples = 516 value = [9, 447, 2, 58, 0] class = t 617->619 620 serror_rate ≤ 0.03 entropy = 0.994 samples = 138 value = [1, 95, 1, 41, 0] class = t 619->620 667 srv_serror_rate ≤ 0.54 entropy = 0.437 samples = 378 value = [8, 352, 1, 17, 0] class = t 619->667 621 dst_host_serror_rate ≤ 0.37 entropy = 1.082 samples = 83 value = [0, 42, 1, 40, 0] class = t 620->621 656 dst_host_serror_rate ≤ 0.415 entropy = 0.262 samples = 55 value = [1, 53, 0, 1, 0] class = t 620->656 622 dst_host_srv_serror_rate ≤ 0.035 entropy = 1.08 samples = 72 value = [0, 31, 1, 40, 0] class = a 621->622 655 entropy = 0.0 samples = 11 value = [0, 11, 0, 0, 0] class = t 621->655 623 dst_host_serror_rate ≤ 0.14 entropy = 1.188 samples = 20 value = [0, 12, 1, 7, 0] class = t 622->623 634 dst_host_srv_serror_rate ≤ 0.075 entropy = 0.947 samples = 52 value = [0, 19, 0, 33, 0] class = a 622->634 624 dst_host_srv_serror_rate ≤ 0.025 entropy = 0.439 samples = 11 value = [0, 10, 1, 0, 0] class = t 623->624 629 dst_host_serror_rate ≤ 0.235 entropy = 0.764 samples = 9 value = [0, 2, 0, 7, 0] class = a 623->629 625 entropy = 0.0 samples = 8 value = [0, 8, 0, 0, 0] class = t 624->625 626 dst_host_serror_rate ≤ 0.105 entropy = 0.918 samples = 3 value = [0, 2, 1, 0, 0] class = t 624->626 627 entropy = 0.0 samples = 1 value = [0, 0, 1, 0, 0] class = t 626->627 628 entropy = 0.0 samples = 2 value = [0, 2, 0, 0, 0] class = t 626->628 630 entropy = 0.0 samples = 5 value = [0, 0, 0, 5, 0] class = a 629->630 631 dst_host_serror_rate ≤ 0.29 entropy = 1.0 samples = 4 value = [0, 2, 0, 2, 0] class = t 629->631 632 entropy = 1.0 samples = 2 value = [0, 1, 0, 1, 0] class = t 631->632 633 entropy = 1.0 samples = 2 value = [0, 1, 0, 1, 0] class = t 631->633 635 dst_host_serror_rate ≤ 0.055 entropy = 0.863 samples = 42 value = [0, 12, 0, 30, 0] class = a 634->635 650 dst_host_serror_rate ≤ 0.06 entropy = 0.881 samples = 10 value = [0, 7, 0, 3, 0] class = t 634->650 636 dst_host_srv_serror_rate ≤ 0.055 entropy = 0.918 samples = 27 value = [0, 9, 0, 18, 0] class = a 635->636 643 dst_host_srv_serror_rate ≤ 0.05 entropy = 0.722 samples = 15 value = [0, 3, 0, 12, 0] class = a 635->643 637 dst_host_srv_serror_rate ≤ 0.045 entropy = 0.755 samples = 23 value = [0, 5, 0, 18, 0] class = a 636->637 642 entropy = 0.0 samples = 4 value = [0, 4, 0, 0, 0] class = t 636->642 638 dst_host_serror_rate ≤ 0.045 entropy = 0.918 samples = 9 value = [0, 3, 0, 6, 0] class = a 637->638 641 entropy = 0.592 samples = 14 value = [0, 2, 0, 12, 0] class = a 637->641 639 entropy = 0.811 samples = 8 value = [0, 2, 0, 6, 0] class = a 638->639 640 entropy = 0.0 samples = 1 value = [0, 1, 0, 0, 0] class = t 638->640 644 entropy = 0.0 samples = 1 value = [0, 1, 0, 0, 0] class = t 643->644 645 dst_host_srv_serror_rate ≤ 0.065 entropy = 0.592 samples = 14 value = [0, 2, 0, 12, 0] class = a 643->645 646 entropy = 0.0 samples = 7 value = [0, 0, 0, 7, 0] class = a 645->646 647 dst_host_serror_rate ≤ 0.065 entropy = 0.863 samples = 7 value = [0, 2, 0, 5, 0] class = a 645->647 648 entropy = 0.0 samples = 1 value = [0, 1, 0, 0, 0] class = t 647->648 649 entropy = 0.65 samples = 6 value = [0, 1, 0, 5, 0] class = a 647->649 651 entropy = 0.0 samples = 2 value = [0, 2, 0, 0, 0] class = t 650->651 652 dst_host_serror_rate ≤ 0.1 entropy = 0.954 samples = 8 value = [0, 5, 0, 3, 0] class = t 650->652 653 entropy = 1.0 samples = 6 value = [0, 3, 0, 3, 0] class = t 652->653 654 entropy = 0.0 samples = 2 value = [0, 2, 0, 0, 0] class = t 652->654 657 serror_rate ≤ 0.185 entropy = 0.135 samples = 53 value = [1, 52, 0, 0, 0] class = t 656->657 664 srv_serror_rate ≤ 0.305 entropy = 1.0 samples = 2 value = [0, 1, 0, 1, 0] class = t 656->664 658 dst_host_serror_rate ≤ 0.055 entropy = 0.592 samples = 7 value = [1, 6, 0, 0, 0] class = t 657->658 663 entropy = 0.0 samples = 46 value = [0, 46, 0, 0, 0] class = t 657->663 659 srv_serror_rate ≤ 0.125 entropy = 0.918 samples = 3 value = [1, 2, 0, 0, 0] class = t 658->659 662 entropy = 0.0 samples = 4 value = [0, 4, 0, 0, 0] class = t 658->662 660 entropy = 0.0 samples = 2 value = [0, 2, 0, 0, 0] class = t 659->660 661 entropy = 0.0 samples = 1 value = [1, 0, 0, 0, 0] class = a 659->661 665 entropy = 0.0 samples = 1 value = [0, 1, 0, 0, 0] class = t 664->665 666 entropy = 0.0 samples = 1 value = [0, 0, 0, 1, 0] class = a 664->666 668 dst_host_serror_rate ≤ 0.405 entropy = 0.234 samples = 315 value = [0, 304, 1, 10, 0] class = t 667->668 711 dst_host_serror_rate ≤ 0.45 entropy = 1.029 samples = 63 value = [8, 48, 0, 7, 0] class = t 667->711 669 dst_host_serror_rate ≤ 0.085 entropy = 0.448 samples = 133 value = [0, 122, 1, 10, 0] class = t 668->669 710 entropy = 0.0 samples = 182 value = [0, 182, 0, 0, 0] class = t 668->710 670 dst_host_srv_serror_rate ≤ 0.315 entropy = 0.216 samples = 29 value = [0, 28, 1, 0, 0] class = t 669->670 675 dst_host_srv_serror_rate ≤ 0.405 entropy = 0.457 samples = 104 value = [0, 94, 0, 10, 0] class = t 669->675 671 entropy = 0.0 samples = 26 value = [0, 26, 0, 0, 0] class = t 670->671 672 dst_host_serror_rate ≤ 0.06 entropy = 0.918 samples = 3 value = [0, 2, 1, 0, 0] class = t 670->672 673 entropy = 0.0 samples = 1 value = [0, 0, 1, 0, 0] class = t 672->673 674 entropy = 0.0 samples = 2 value = [0, 2, 0, 0, 0] class = t 672->674 676 dst_host_serror_rate ≤ 0.385 entropy = 0.535 samples = 82 value = [0, 72, 0, 10, 0] class = t 675->676 709 entropy = 0.0 samples = 22 value = [0, 22, 0, 0, 0] class = t 675->709 677 dst_host_srv_serror_rate ≤ 0.335 entropy = 0.503 samples = 81 value = [0, 72, 0, 9, 0] class = t 676->677 708 entropy = 0.0 samples = 1 value = [0, 0, 0, 1, 0] class = a 676->708 678 srv_serror_rate ≤ 0.04 entropy = 0.548 samples = 71 value = [0, 62, 0, 9, 0] class = t 677->678 707 entropy = 0.0 samples = 10 value = [0, 10, 0, 0, 0] class = t 677->707 679 dst_host_serror_rate ≤ 0.335 entropy = 0.592 samples = 63 value = [0, 54, 0, 9, 0] class = t 678->679 706 entropy = 0.0 samples = 8 value = [0, 8, 0, 0, 0] class = t 678->706 680 dst_host_serror_rate ≤ 0.185 entropy = 0.604 samples = 61 value = [0, 52, 0, 9, 0] class = t 679->680 705 entropy = 0.0 samples = 2 value = [0, 2, 0, 0, 0] class = t 679->705 681 dst_host_srv_serror_rate ≤ 0.155 entropy = 0.527 samples = 42 value = [0, 37, 0, 5, 0] class = t 680->681 696 dst_host_serror_rate ≤ 0.225 entropy = 0.742 samples = 19 value = [0, 15, 0, 4, 0] class = t 680->696 682 dst_host_srv_serror_rate ≤ 0.105 entropy = 0.722 samples = 25 value = [0, 20, 0, 5, 0] class = t 681->682 695 entropy = 0.0 samples = 17 value = [0, 17, 0, 0, 0] class = t 681->695 683 dst_host_srv_serror_rate ≤ 0.095 entropy = 0.811 samples = 8 value = [0, 6, 0, 2, 0] class = t 682->683 686 dst_host_serror_rate ≤ 0.105 entropy = 0.672 samples = 17 value = [0, 14, 0, 3, 0] class = t 682->686 684 entropy = 0.811 samples = 4 value = [0, 3, 0, 1, 0] class = t 683->684 685 entropy = 0.811 samples = 4 value = [0, 3, 0, 1, 0] class = t 683->685 687 entropy = 0.0 samples = 1 value = [0, 1, 0, 0, 0] class = t 686->687 688 dst_host_serror_rate ≤ 0.115 entropy = 0.696 samples = 16 value = [0, 13, 0, 3, 0] class = t 686->688 689 entropy = 0.811 samples = 4 value = [0, 3, 0, 1, 0] class = t 688->689 690 dst_host_serror_rate ≤ 0.135 entropy = 0.65 samples = 12 value = [0, 10, 0, 2, 0] class = t 688->690 691 dst_host_serror_rate ≤ 0.125 entropy = 0.544 samples = 8 value = [0, 7, 0, 1, 0] class = t 690->691 694 entropy = 0.811 samples = 4 value = [0, 3, 0, 1, 0] class = t 690->694 692 entropy = 0.592 samples = 7 value = [0, 6, 0, 1, 0] class = t 691->692 693 entropy = 0.0 samples = 1 value = [0, 1, 0, 0, 0] class = t 691->693 697 entropy = 0.0 samples = 2 value = [0, 0, 0, 2, 0] class = a 696->697 698 dst_host_srv_serror_rate ≤ 0.225 entropy = 0.523 samples = 17 value = [0, 15, 0, 2, 0] class = t 696->698 699 entropy = 0.0 samples = 6 value = [0, 6, 0, 0, 0] class = t 698->699 700 dst_host_serror_rate ≤ 0.31 entropy = 0.684 samples = 11 value = [0, 9, 0, 2, 0] class = t 698->700 701 dst_host_srv_serror_rate ≤ 0.28 entropy = 0.469 samples = 10 value = [0, 9, 0, 1, 0] class = t 700->701 704 entropy = 0.0 samples = 1 value = [0, 0, 0, 1, 0] class = a 700->704 702 entropy = 1.0 samples = 2 value = [0, 1, 0, 1, 0] class = t 701->702 703 entropy = 0.0 samples = 8 value = [0, 8, 0, 0, 0] class = t 701->703 712 entropy = 0.0 samples = 44 value = [0, 44, 0, 0, 0] class = t 711->712 713 srv_serror_rate ≤ 0.88 entropy = 1.529 samples = 19 value = [8, 4, 0, 7, 0] class = a 711->713 714 entropy = 0.0 samples = 6 value = [0, 0, 0, 6, 0] class = a 713->714 715 dst_host_srv_serror_rate ≤ 0.35 entropy = 1.239 samples = 13 value = [8, 4, 0, 1, 0] class = a 713->715 716 dst_host_serror_rate ≤ 0.585 entropy = 0.722 samples = 5 value = [1, 4, 0, 0, 0] class = t 715->716 721 dst_host_serror_rate ≤ 0.575 entropy = 0.544 samples = 8 value = [7, 0, 0, 1, 0] class = a 715->721 717 dst_host_serror_rate ≤ 0.555 entropy = 1.0 samples = 2 value = [1, 1, 0, 0, 0] class = a 716->717 720 entropy = 0.0 samples = 3 value = [0, 3, 0, 0, 0] class = t 716->720 718 entropy = 0.0 samples = 1 value = [0, 1, 0, 0, 0] class = t 717->718 719 entropy = 0.0 samples = 1 value = [1, 0, 0, 0, 0] class = a 717->719 722 dst_host_serror_rate ≤ 0.525 entropy = 1.0 samples = 2 value = [1, 0, 0, 1, 0] class = a 721->722 725 entropy = 0.0 samples = 6 value = [6, 0, 0, 0, 0] class = a 721->725 723 entropy = 0.0 samples = 1 value = [1, 0, 0, 0, 0] class = a 722->723 724 entropy = 0.0 samples = 1 value = [0, 0, 0, 1, 0] class = a 722->724 727 entropy = 0.0 samples = 38 value = [0, 38, 0, 0, 0] class = t 726->727 728 dst_host_srv_serror_rate ≤ 0.035 entropy = 0.462 samples = 39 value = [36, 2, 1, 0, 0] class = a 726->728 729 dst_host_serror_rate ≤ 0.94 entropy = 0.918 samples = 3 value = [2, 0, 1, 0, 0] class = a 728->729 732 dst_host_serror_rate ≤ 0.935 entropy = 0.31 samples = 36 value = [34, 2, 0, 0, 0] class = a 728->732 730 entropy = 0.0 samples = 2 value = [2, 0, 0, 0, 0] class = a 729->730 731 entropy = 0.0 samples = 1 value = [0, 0, 1, 0, 0] class = t 729->731 733 dst_host_srv_serror_rate ≤ 0.675 entropy = 0.592 samples = 14 value = [12, 2, 0, 0, 0] class = a 732->733 738 entropy = 0.0 samples = 22 value = [22, 0, 0, 0, 0] class = a 732->738 734 srv_serror_rate ≤ 0.9 entropy = 0.971 samples = 5 value = [3, 2, 0, 0, 0] class = a 733->734 737 entropy = 0.0 samples = 9 value = [9, 0, 0, 0, 0] class = a 733->737 735 entropy = 0.0 samples = 3 value = [3, 0, 0, 0, 0] class = a 734->735 736 entropy = 0.0 samples = 2 value = [0, 2, 0, 0, 0] class = t 734->736 740 dst_host_serror_rate ≤ 0.015 entropy = 0.619 samples = 13 value = [0, 11, 2, 0, 0] class = t 739->740 743 dst_host_serror_rate ≤ 0.905 entropy = 0.439 samples = 154 value = [14, 0, 140, 0, 0] class = t 739->743 741 entropy = 0.469 samples = 10 value = [0, 9, 1, 0, 0] class = t 740->741 742 entropy = 0.918 samples = 3 value = [0, 2, 1, 0, 0] class = t 740->742 744 dst_host_serror_rate ≤ 0.29 entropy = 0.764 samples = 63 value = [14, 0, 49, 0, 0] class = t 743->744 779 entropy = 0.0 samples = 91 value = [0, 0, 91, 0, 0] class = t 743->779 745 entropy = 0.0 samples = 2 value = [0, 0, 2, 0, 0] class = t 744->745 746 dst_host_serror_rate ≤ 0.53 entropy = 0.777 samples = 61 value = [14, 0, 47, 0, 0] class = t 744->746 747 entropy = 0.0 samples = 1 value = [1, 0, 0, 0, 0] class = a 746->747 748 dst_host_serror_rate ≤ 0.815 entropy = 0.754 samples = 60 value = [13, 0, 47, 0, 0] class = t 746->748 749 dst_host_serror_rate ≤ 0.785 entropy = 0.575 samples = 22 value = [3, 0, 19, 0, 0] class = t 748->749 762 dst_host_serror_rate ≤ 0.885 entropy = 0.831 samples = 38 value = [10, 0, 28, 0, 0] class = t 748->762 750 dst_host_serror_rate ≤ 0.59 entropy = 0.672 samples = 17 value = [3, 0, 14, 0, 0] class = t 749->750 761 entropy = 0.0 samples = 5 value = [0, 0, 5, 0, 0] class = t 749->761 751 entropy = 0.0 samples = 2 value = [0, 0, 2, 0, 0] class = t 750->751 752 dst_host_serror_rate ≤ 0.61 entropy = 0.722 samples = 15 value = [3, 0, 12, 0, 0] class = t 750->752 753 entropy = 1.0 samples = 2 value = [1, 0, 1, 0, 0] class = a 752->753 754 dst_host_serror_rate ≤ 0.7 entropy = 0.619 samples = 13 value = [2, 0, 11, 0, 0] class = t 752->754 755 entropy = 0.0 samples = 3 value = [0, 0, 3, 0, 0] class = t 754->755 756 dst_host_serror_rate ≤ 0.715 entropy = 0.722 samples = 10 value = [2, 0, 8, 0, 0] class = t 754->756 757 entropy = 1.0 samples = 2 value = [1, 0, 1, 0, 0] class = a 756->757 758 dst_host_serror_rate ≤ 0.77 entropy = 0.544 samples = 8 value = [1, 0, 7, 0, 0] class = t 756->758 759 entropy = 0.0 samples = 5 value = [0, 0, 5, 0, 0] class = t 758->759 760 entropy = 0.918 samples = 3 value = [1, 0, 2, 0, 0] class = t 758->760 763 dst_host_serror_rate ≤ 0.855 entropy = 0.902 samples = 22 value = [7, 0, 15, 0, 0] class = t 762->763 776 dst_host_serror_rate ≤ 0.895 entropy = 0.696 samples = 16 value = [3, 0, 13, 0, 0] class = t 762->776 764 dst_host_serror_rate ≤ 0.825 entropy = 0.811 samples = 12 value = [3, 0, 9, 0, 0] class = t 763->764 771 dst_host_serror_rate ≤ 0.865 entropy = 0.971 samples = 10 value = [4, 0, 6, 0, 0] class = t 763->771 765 entropy = 1.0 samples = 2 value = [1, 0, 1, 0, 0] class = a 764->765 766 dst_host_serror_rate ≤ 0.835 entropy = 0.722 samples = 10 value = [2, 0, 8, 0, 0] class = t 764->766 767 entropy = 0.811 samples = 4 value = [1, 0, 3, 0, 0] class = t 766->767 768 dst_host_serror_rate ≤ 0.845 entropy = 0.65 samples = 6 value = [1, 0, 5, 0, 0] class = t 766->768 769 entropy = 0.0 samples = 1 value = [0, 0, 1, 0, 0] class = t 768->769 770 entropy = 0.722 samples = 5 value = [1, 0, 4, 0, 0] class = t 768->770 772 entropy = 0.918 samples = 3 value = [1, 0, 2, 0, 0] class = t 771->772 773 dst_host_serror_rate ≤ 0.875 entropy = 0.985 samples = 7 value = [3, 0, 4, 0, 0] class = t 771->773 774 entropy = 1.0 samples = 2 value = [1, 0, 1, 0, 0] class = a 773->774 775 entropy = 0.971 samples = 5 value = [2, 0, 3, 0, 0] class = t 773->775 777 entropy = 0.764 samples = 9 value = [2, 0, 7, 0, 0] class = t 776->777 778 entropy = 0.592 samples = 7 value = [1, 0, 6, 0, 0] class = t 776->778 781 dst_host_srv_serror_rate ≤ 0.015 entropy = 0.126 samples = 58 value = [0, 57, 0, 1, 0] class = t 780->781 788 same_srv_rate ≤ 0.975 entropy = 0.488 samples = 812 value = [746, 17, 47, 2, 0] class = a 780->788 782 entropy = 0.0 samples = 45 value = [0, 45, 0, 0, 0] class = t 781->782 783 dst_host_srv_serror_rate ≤ 0.025 entropy = 0.391 samples = 13 value = [0, 12, 0, 1, 0] class = t 781->783 784 srv_serror_rate ≤ 0.65 entropy = 0.65 samples = 6 value = [0, 5, 0, 1, 0] class = t 783->784 787 entropy = 0.0 samples = 7 value = [0, 7, 0, 0, 0] class = t 783->787 785 entropy = 0.0 samples = 3 value = [0, 3, 0, 0, 0] class = t 784->785 786 entropy = 0.918 samples = 3 value = [0, 2, 0, 1, 0] class = t 784->786 789 entropy = 0.0 samples = 446 value = [446, 0, 0, 0, 0] class = a 788->789 790 dst_host_srv_serror_rate ≤ 0.99 entropy = 0.862 samples = 366 value = [300, 17, 47, 2, 0] class = a 788->790 791 srv_serror_rate ≤ 0.165 entropy = 0.412 samples = 162 value = [150, 11, 1, 0, 0] class = a 790->791 808 dst_host_serror_rate ≤ 0.98 entropy = 1.026 samples = 204 value = [150, 6, 46, 2, 0] class = a 790->808 792 entropy = 0.0 samples = 8 value = [0, 8, 0, 0, 0] class = t 791->792 793 dst_host_srv_serror_rate ≤ 0.335 entropy = 0.195 samples = 154 value = [150, 3, 1, 0, 0] class = a 791->793 794 dst_host_serror_rate ≤ 0.99 entropy = 0.529 samples = 25 value = [22, 3, 0, 0, 0] class = a 793->794 803 dst_host_serror_rate ≤ 0.975 entropy = 0.065 samples = 129 value = [128, 0, 1, 0, 0] class = a 793->803 795 entropy = 0.0 samples = 15 value = [15, 0, 0, 0, 0] class = a 794->795 796 dst_host_srv_serror_rate ≤ 0.315 entropy = 0.881 samples = 10 value = [7, 3, 0, 0, 0] class = a 794->796 797 dst_host_srv_serror_rate ≤ 0.145 entropy = 0.764 samples = 9 value = [7, 2, 0, 0, 0] class = a 796->797 802 entropy = 0.0 samples = 1 value = [0, 1, 0, 0, 0] class = t 796->802 798 entropy = 0.0 samples = 3 value = [3, 0, 0, 0, 0] class = a 797->798 799 dst_host_srv_serror_rate ≤ 0.195 entropy = 0.918 samples = 6 value = [4, 2, 0, 0, 0] class = a 797->799 800 entropy = 1.0 samples = 4 value = [2, 2, 0, 0, 0] class = a 799->800 801 entropy = 0.0 samples = 2 value = [2, 0, 0, 0, 0] class = a 799->801 804 dst_host_srv_serror_rate ≤ 0.725 entropy = 0.722 samples = 5 value = [4, 0, 1, 0, 0] class = a 803->804 807 entropy = 0.0 samples = 124 value = [124, 0, 0, 0, 0] class = a 803->807 805 entropy = 0.0 samples = 1 value = [0, 0, 1, 0, 0] class = t 804->805 806 entropy = 0.0 samples = 4 value = [4, 0, 0, 0, 0] class = a 804->806 809 entropy = 0.0 samples = 18 value = [0, 0, 18, 0, 0] class = t 808->809 810 srv_serror_rate ≤ 0.975 entropy = 0.892 samples = 186 value = [150, 6, 28, 2, 0] class = a 808->810 811 srv_serror_rate ≤ 0.745 entropy = 0.414 samples = 12 value = [11, 0, 0, 1, 0] class = a 810->811 816 dst_host_serror_rate ≤ 0.995 entropy = 0.893 samples = 174 value = [139, 6, 28, 1, 0] class = a 810->816 812 srv_serror_rate ≤ 0.54 entropy = 1.0 samples = 2 value = [1, 0, 0, 1, 0] class = a 811->812 815 entropy = 0.0 samples = 10 value = [10, 0, 0, 0, 0] class = a 811->815 813 entropy = 0.0 samples = 1 value = [1, 0, 0, 0, 0] class = a 812->813 814 entropy = 0.0 samples = 1 value = [0, 0, 0, 1, 0] class = a 812->814 817 entropy = 0.0 samples = 2 value = [2, 0, 0, 0, 0] class = a 816->817 818 entropy = 0.9 samples = 172 value = [137, 6, 28, 1, 0] class = a 816->818

2.Gini Criteria

In [51]:
X = best_feautres_using_corr
y = dataset['attack_type']

X_train, X_test, y_train, y_test = train_test_split(X, y, test_size=0.2, random_state=42)
In [52]:
clf_corr_using_gini = DecisionTreeClassifier(criterion='gini', random_state=42)
clf_corr_using_gini.fit(X_train, y_train)
Out[52]:
DecisionTreeClassifier(random_state=42)
In [53]:
y_pred = clf_corr_using_gini.predict(X_test)
In [54]:
# calculate F1 score
cm = confusion_matrix(y_test, y_pred)
f1 = f1_score(y_test, y_pred, average='weighted')
print("F1 Score:", f1)

# calculate accuracy
accuracy = accuracy_score(y_test, y_pred)
print("Accuracy:", accuracy)

# calculate error rate
error_rate = 1 - accuracy
print("Error Rate:", error_rate)

# plot confusion matrix
sns.heatmap(cm, annot=True, cmap="Blues")
plt.title("Confusion Matrix")
plt.xlabel("Predicted Labels")
plt.ylabel("True Labels")
plt.savefig("cm_dt_corr_gini.png")
plt.show()
F1 Score: 0.8623194516628205
Accuracy: 0.8806112323873785
Error Rate: 0.11938876761262152

Inference:

  1. The diagnol shows correctly predicted values. The attack is actually 0 and the model also predicted it as 0 same goes for all the diagnol values like second rows diagnol true value is 1 predicted value is also 1.
  2. The confusion matrix shows that 8.2e + 03 values are predicted correctely True value is 0 and the predicted value is also 0.
  3. Second row first column shows that 1.1e+02 values are predicted wrong True value is 1 but model predicted it as 0.
  4. Same goes for all the confusion matrix.
In [55]:
# Visualize the decision tree
dot_data = export_graphviz(clf_corr_using_gini, out_file=None, 
                           feature_names=top_5_cols_using_corr,  
                           class_names='attack_type',  
                           filled=True, rounded=True,  
                           special_characters=True)  
# graph = graphviz.Source(dot_data)  
# graph.render("iris_decision_tree")
graph = graphviz.Source(dot_data)
display(SVG(graph.pipe(format='svg')))
Tree 0 same_srv_rate ≤ 0.495 gini = 0.572 samples = 100778 value = [36746, 53921, 9299, 771, 41] class = t 1 dst_host_serror_rate ≤ 0.665 gini = 0.209 samples = 36438 value = [32257, 1433, 2746, 0, 2] class = a 0->1 True 224 dst_host_serror_rate ≤ 0.965 gini = 0.319 samples = 64340 value = [4489, 52488, 6553, 771, 39] class = t 0->224 False 2 dst_host_serror_rate ≤ 0.005 gini = 0.571 samples = 9751 value = [5596, 1409, 2744, 0, 2] class = a 1->2 217 dst_host_srv_serror_rate ≤ 0.03 gini = 0.002 samples = 26687 value = [26661, 24, 2, 0, 0] class = a 1->217 3 same_srv_rate ≤ 0.165 gini = 0.439 samples = 7612 value = [5495, 1222, 893, 0, 2] class = a 2->3 124 same_srv_rate ≤ 0.035 gini = 0.241 samples = 2139 value = [101, 187, 1851, 0, 0] class = t 2->124 4 serror_rate ≤ 0.005 gini = 0.295 samples = 6355 value = [5276, 392, 685, 0, 2] class = a 3->4 47 same_srv_rate ≤ 0.195 gini = 0.506 samples = 1257 value = [219, 830, 208, 0, 0] class = t 3->47 5 same_srv_rate ≤ 0.005 gini = 0.261 samples = 6183 value = [5276, 364, 543, 0, 0] class = a 4->5 42 same_srv_rate ≤ 0.035 gini = 0.292 samples = 172 value = [0, 28, 142, 0, 2] class = t 4->42 6 gini = 0.57 samples = 272 value = [140, 24, 108, 0, 0] class = a 5->6 7 same_srv_rate ≤ 0.135 gini = 0.236 samples = 5911 value = [5136, 340, 435, 0, 0] class = a 5->7 8 same_srv_rate ≤ 0.075 gini = 0.203 samples = 5434 value = [4829, 205, 400, 0, 0] class = a 7->8 37 same_srv_rate ≤ 0.145 gini = 0.5 samples = 477 value = [307, 135, 35, 0, 0] class = a 7->37 9 same_srv_rate ≤ 0.015 gini = 0.163 samples = 3934 value = [3587, 66, 281, 0, 0] class = a 8->9 24 same_srv_rate ≤ 0.125 gini = 0.3 samples = 1500 value = [1242, 139, 119, 0, 0] class = a 8->24 10 dst_host_srv_serror_rate ≤ 0.045 gini = 0.308 samples = 577 value = [471, 14, 92, 0, 0] class = a 9->10 13 same_srv_rate ≤ 0.025 gini = 0.135 samples = 3357 value = [3116, 52, 189, 0, 0] class = a 9->13 11 gini = 0.306 samples = 576 value = [471, 14, 91, 0, 0] class = a 10->11 12 gini = 0.0 samples = 1 value = [0, 0, 1, 0, 0] class = t 10->12 14 gini = 0.183 samples = 588 value = [529, 10, 49, 0, 0] class = a 13->14 15 same_srv_rate ≤ 0.045 gini = 0.124 samples = 2769 value = [2587, 42, 140, 0, 0] class = a 13->15 16 same_srv_rate ≤ 0.035 gini = 0.136 samples = 1094 value = [1015, 16, 63, 0, 0] class = a 15->16 19 same_srv_rate ≤ 0.055 gini = 0.117 samples = 1675 value = [1572, 26, 77, 0, 0] class = a 15->19 17 gini = 0.109 samples = 540 value = [509, 4, 27, 0, 0] class = a 16->17 18 gini = 0.161 samples = 554 value = [506, 12, 36, 0, 0] class = a 16->18 20 gini = 0.096 samples = 540 value = [513, 9, 18, 0, 0] class = a 19->20 21 same_srv_rate ≤ 0.065 gini = 0.127 samples = 1135 value = [1059, 17, 59, 0, 0] class = a 19->21 22 gini = 0.122 samples = 573 value = [536, 6, 31, 0, 0] class = a 21->22 23 gini = 0.131 samples = 562 value = [523, 11, 28, 0, 0] class = a 21->23 25 same_srv_rate ≤ 0.115 gini = 0.329 samples = 1282 value = [1035, 135, 112, 0, 0] class = a 24->25 36 gini = 0.097 samples = 218 value = [207, 4, 7, 0, 0] class = a 24->36 26 same_srv_rate ≤ 0.085 gini = 0.292 samples = 1001 value = [834, 75, 92, 0, 0] class = a 25->26 33 dst_host_srv_serror_rate ≤ 0.005 gini = 0.438 samples = 281 value = [201, 60, 20, 0, 0] class = a 25->33 27 gini = 0.324 samples = 353 value = [286, 23, 44, 0, 0] class = a 26->27 28 same_srv_rate ≤ 0.095 gini = 0.273 samples = 648 value = [548, 52, 48, 0, 0] class = a 26->28 29 gini = 0.215 samples = 229 value = [202, 11, 16, 0, 0] class = a 28->29 30 same_srv_rate ≤ 0.105 gini = 0.303 samples = 419 value = [346, 41, 32, 0, 0] class = a 28->30 31 gini = 0.315 samples = 219 value = [179, 22, 18, 0, 0] class = a 30->31 32 gini = 0.289 samples = 200 value = [167, 19, 14, 0, 0] class = a 30->32 34 gini = 0.434 samples = 280 value = [201, 60, 19, 0, 0] class = a 33->34 35 gini = 0.0 samples = 1 value = [0, 0, 1, 0, 0] class = t 33->35 38 gini = 0.548 samples = 300 value = [158, 124, 18, 0, 0] class = a 37->38 39 same_srv_rate ≤ 0.155 gini = 0.278 samples = 177 value = [149, 11, 17, 0, 0] class = a 37->39 40 gini = 0.326 samples = 105 value = [85, 8, 12, 0, 0] class = a 39->40 41 gini = 0.203 samples = 72 value = [64, 3, 5, 0, 0] class = a 39->41 43 serror_rate ≤ 0.965 gini = 0.027 samples = 144 value = [0, 0, 142, 0, 2] class = t 42->43 46 gini = 0.0 samples = 28 value = [0, 28, 0, 0, 0] class = t 42->46 44 gini = 0.0 samples = 141 value = [0, 0, 141, 0, 0] class = t 43->44 45 gini = 0.444 samples = 3 value = [0, 0, 1, 0, 2] class = c 43->45 48 same_srv_rate ≤ 0.175 gini = 0.629 samples = 228 value = [105, 80, 43, 0, 0] class = a 47->48 55 same_srv_rate ≤ 0.335 gini = 0.431 samples = 1029 value = [114, 750, 165, 0, 0] class = t 47->55 49 serror_rate ≤ 0.085 gini = 0.635 samples = 124 value = [46, 54, 24, 0, 0] class = t 48->49 52 same_srv_rate ≤ 0.185 gini = 0.582 samples = 104 value = [59, 26, 19, 0, 0] class = a 48->52 50 gini = 0.636 samples = 123 value = [46, 53, 24, 0, 0] class = t 49->50 51 gini = 0.0 samples = 1 value = [0, 1, 0, 0, 0] class = t 49->51 53 gini = 0.619 samples = 71 value = [36, 20, 15, 0, 0] class = a 52->53 54 gini = 0.466 samples = 33 value = [23, 6, 4, 0, 0] class = a 52->54 56 same_srv_rate ≤ 0.325 gini = 0.347 samples = 883 value = [78, 702, 103, 0, 0] class = t 55->56 93 same_srv_rate ≤ 0.395 gini = 0.651 samples = 146 value = [36, 48, 62, 0, 0] class = t 55->93 57 same_srv_rate ≤ 0.255 gini = 0.429 samples = 577 value = [76, 422, 79, 0, 0] class = t 56->57 88 serror_rate ≤ 0.085 gini = 0.157 samples = 306 value = [2, 280, 24, 0, 0] class = t 56->88 58 same_srv_rate ≤ 0.205 gini = 0.351 samples = 510 value = [58, 404, 48, 0, 0] class = t 57->58 75 same_srv_rate ≤ 0.315 gini = 0.642 samples = 67 value = [18, 18, 31, 0, 0] class = t 57->75 59 serror_rate ≤ 0.1 gini = 0.254 samples = 253 value = [17, 217, 19, 0, 0] class = t 58->59 64 same_srv_rate ≤ 0.245 gini = 0.432 samples = 257 value = [41, 187, 29, 0, 0] class = t 58->64 60 dst_host_srv_serror_rate ≤ 0.005 gini = 0.258 samples = 249 value = [17, 213, 19, 0, 0] class = t 59->60 63 gini = 0.0 samples = 4 value = [0, 4, 0, 0, 0] class = t 59->63 61 gini = 0.259 samples = 248 value = [17, 212, 19, 0, 0] class = t 60->61 62 gini = 0.0 samples = 1 value = [0, 1, 0, 0, 0] class = t 60->62 65 same_srv_rate ≤ 0.225 gini = 0.637 samples = 82 value = [31, 35, 16, 0, 0] class = t 64->65 72 dst_host_srv_serror_rate ≤ 0.005 gini = 0.237 samples = 175 value = [10, 152, 13, 0, 0] class = t 64->72 66 same_srv_rate ≤ 0.215 gini = 0.603 samples = 57 value = [17, 30, 10, 0, 0] class = t 65->66 69 same_srv_rate ≤ 0.235 gini = 0.589 samples = 25 value = [14, 5, 6, 0, 0] class = a 65->69 67 gini = 0.64 samples = 25 value = [10, 10, 5, 0, 0] class = a 66->67 68 gini = 0.537 samples = 32 value = [7, 20, 5, 0, 0] class = t 66->68 70 gini = 0.595 samples = 11 value = [6, 3, 2, 0, 0] class = a 69->70 71 gini = 0.571 samples = 14 value = [8, 2, 4, 0, 0] class = a 69->71 73 gini = 0.238 samples = 174 value = [10, 151, 13, 0, 0] class = t 72->73 74 gini = 0.0 samples = 1 value = [0, 1, 0, 0, 0] class = t 72->74 76 same_srv_rate ≤ 0.285 gini = 0.644 samples = 58 value = [14, 18, 26, 0, 0] class = t 75->76 87 gini = 0.494 samples = 9 value = [4, 0, 5, 0, 0] class = t 75->87 77 same_srv_rate ≤ 0.275 gini = 0.601 samples = 26 value = [7, 5, 14, 0, 0] class = t 76->77 82 same_srv_rate ≤ 0.295 gini = 0.646 samples = 32 value = [7, 13, 12, 0, 0] class = t 76->82 78 same_srv_rate ≤ 0.265 gini = 0.609 samples = 19 value = [5, 4, 10, 0, 0] class = t 77->78 81 gini = 0.571 samples = 7 value = [2, 1, 4, 0, 0] class = t 77->81 79 gini = 0.625 samples = 4 value = [1, 1, 2, 0, 0] class = t 78->79 80 gini = 0.604 samples = 15 value = [4, 3, 8, 0, 0] class = t 78->80 83 gini = 0.551 samples = 15 value = [2, 9, 4, 0, 0] class = t 82->83 84 same_srv_rate ≤ 0.305 gini = 0.637 samples = 17 value = [5, 4, 8, 0, 0] class = t 82->84 85 gini = 0.642 samples = 9 value = [3, 2, 4, 0, 0] class = t 84->85 86 gini = 0.625 samples = 8 value = [2, 2, 4, 0, 0] class = t 84->86 89 dst_host_srv_serror_rate ≤ 0.025 gini = 0.159 samples = 300 value = [2, 274, 24, 0, 0] class = t 88->89 92 gini = 0.0 samples = 6 value = [0, 6, 0, 0, 0] class = t 88->92 90 gini = 0.16 samples = 299 value = [2, 273, 24, 0, 0] class = t 89->90 91 gini = 0.0 samples = 1 value = [0, 1, 0, 0, 0] class = t 89->91 94 same_srv_rate ≤ 0.375 gini = 0.59 samples = 55 value = [23, 6, 26, 0, 0] class = t 93->94 105 same_srv_rate ≤ 0.405 gini = 0.61 samples = 91 value = [13, 42, 36, 0, 0] class = t 93->105 95 same_srv_rate ≤ 0.355 gini = 0.571 samples = 33 value = [17, 3, 13, 0, 0] class = a 94->95 102 same_srv_rate ≤ 0.385 gini = 0.558 samples = 22 value = [6, 3, 13, 0, 0] class = t 94->102 96 same_srv_rate ≤ 0.345 gini = 0.48 samples = 15 value = [9, 0, 6, 0, 0] class = a 95->96 99 same_srv_rate ≤ 0.365 gini = 0.623 samples = 18 value = [8, 3, 7, 0, 0] class = a 95->99 97 gini = 0.444 samples = 6 value = [4, 0, 2, 0, 0] class = a 96->97 98 gini = 0.494 samples = 9 value = [5, 0, 4, 0, 0] class = a 96->98 100 gini = 0.643 samples = 14 value = [5, 3, 6, 0, 0] class = t 99->100 101 gini = 0.375 samples = 4 value = [3, 0, 1, 0, 0] class = a 99->101 103 gini = 0.582 samples = 14 value = [3, 3, 8, 0, 0] class = t 102->103 104 gini = 0.469 samples = 8 value = [3, 0, 5, 0, 0] class = t 102->104 106 gini = 0.254 samples = 42 value = [2, 36, 4, 0, 0] class = t 105->106 107 same_srv_rate ≤ 0.455 gini = 0.508 samples = 49 value = [11, 6, 32, 0, 0] class = t 105->107 108 same_srv_rate ≤ 0.445 gini = 0.461 samples = 33 value = [7, 3, 23, 0, 0] class = t 107->108 117 same_srv_rate ≤ 0.485 gini = 0.586 samples = 16 value = [4, 3, 9, 0, 0] class = t 107->117 109 same_srv_rate ≤ 0.415 gini = 0.502 samples = 29 value = [7, 3, 19, 0, 0] class = t 108->109 116 gini = 0.0 samples = 4 value = [0, 0, 4, 0, 0] class = t 108->116 110 gini = 0.444 samples = 9 value = [3, 0, 6, 0, 0] class = t 109->110 111 same_srv_rate ≤ 0.425 gini = 0.515 samples = 20 value = [4, 3, 13, 0, 0] class = t 109->111 112 gini = 0.625 samples = 4 value = [1, 1, 2, 0, 0] class = t 111->112 113 same_srv_rate ≤ 0.435 gini = 0.477 samples = 16 value = [3, 2, 11, 0, 0] class = t 111->113 114 gini = 0.43 samples = 11 value = [2, 1, 8, 0, 0] class = t 113->114 115 gini = 0.56 samples = 5 value = [1, 1, 3, 0, 0] class = t 113->115 118 same_srv_rate ≤ 0.475 gini = 0.604 samples = 13 value = [3, 3, 7, 0, 0] class = t 117->118 123 gini = 0.444 samples = 3 value = [1, 0, 2, 0, 0] class = t 117->123 119 same_srv_rate ≤ 0.465 gini = 0.62 samples = 10 value = [3, 2, 5, 0, 0] class = t 118->119 122 gini = 0.444 samples = 3 value = [0, 1, 2, 0, 0] class = t 118->122 120 gini = 0.625 samples = 4 value = [1, 1, 2, 0, 0] class = t 119->120 121 gini = 0.611 samples = 6 value = [2, 1, 3, 0, 0] class = t 119->121 125 serror_rate ≤ 0.89 gini = 0.032 samples = 1559 value = [17, 8, 1534, 0, 0] class = t 124->125 134 serror_rate ≤ 0.02 gini = 0.585 samples = 580 value = [84, 179, 317, 0, 0] class = t 124->134 126 gini = 0.0 samples = 1533 value = [0, 0, 1533, 0, 0] class = t 125->126 127 dst_host_srv_serror_rate ≤ 0.655 gini = 0.476 samples = 26 value = [17, 8, 1, 0, 0] class = a 125->127 128 dst_host_serror_rate ≤ 0.255 gini = 0.32 samples = 10 value = [2, 8, 0, 0, 0] class = t 127->128 131 dst_host_serror_rate ≤ 0.1 gini = 0.117 samples = 16 value = [15, 0, 1, 0, 0] class = a 127->131 129 gini = 0.0 samples = 2 value = [2, 0, 0, 0, 0] class = a 128->129 130 gini = 0.0 samples = 8 value = [0, 8, 0, 0, 0] class = t 128->130 132 gini = 0.0 samples = 1 value = [0, 0, 1, 0, 0] class = t 131->132 133 gini = 0.0 samples = 15 value = [15, 0, 0, 0, 0] class = a 131->133 135 dst_host_srv_serror_rate ≤ 0.005 gini = 0.139 samples = 307 value = [0, 23, 284, 0, 0] class = t 134->135 202 serror_rate ≤ 0.47 gini = 0.564 samples = 273 value = [84, 156, 33, 0, 0] class = t 134->202 136 dst_host_serror_rate ≤ 0.025 gini = 0.118 samples = 302 value = [0, 19, 283, 0, 0] class = t 135->136 197 dst_host_srv_serror_rate ≤ 0.025 gini = 0.32 samples = 5 value = [0, 4, 1, 0, 0] class = t 135->197 137 same_srv_rate ≤ 0.235 gini = 0.299 samples = 71 value = [0, 13, 58, 0, 0] class = t 136->137 170 dst_host_serror_rate ≤ 0.04 gini = 0.051 samples = 231 value = [0, 6, 225, 0, 0] class = t 136->170 138 same_srv_rate ≤ 0.075 gini = 0.137 samples = 54 value = [0, 4, 50, 0, 0] class = t 137->138 159 same_srv_rate ≤ 0.275 gini = 0.498 samples = 17 value = [0, 9, 8, 0, 0] class = t 137->159 139 gini = 0.0 samples = 19 value = [0, 0, 19, 0, 0] class = t 138->139 140 same_srv_rate ≤ 0.085 gini = 0.202 samples = 35 value = [0, 4, 31, 0, 0] class = t 138->140 141 dst_host_serror_rate ≤ 0.015 gini = 0.375 samples = 4 value = [0, 1, 3, 0, 0] class = t 140->141 144 same_srv_rate ≤ 0.105 gini = 0.175 samples = 31 value = [0, 3, 28, 0, 0] class = t 140->144 142 gini = 0.444 samples = 3 value = [0, 1, 2, 0, 0] class = t 141->142 143 gini = 0.0 samples = 1 value = [0, 0, 1, 0, 0] class = t 141->143 145 gini = 0.0 samples = 4 value = [0, 0, 4, 0, 0] class = t 144->145 146 same_srv_rate ≤ 0.115 gini = 0.198 samples = 27 value = [0, 3, 24, 0, 0] class = t 144->146 147 gini = 0.375 samples = 4 value = [0, 1, 3, 0, 0] class = t 146->147 148 same_srv_rate ≤ 0.135 gini = 0.159 samples = 23 value = [0, 2, 21, 0, 0] class = t 146->148 149 gini = 0.0 samples = 5 value = [0, 0, 5, 0, 0] class = t 148->149 150 same_srv_rate ≤ 0.15 gini = 0.198 samples = 18 value = [0, 2, 16, 0, 0] class = t 148->150 151 gini = 0.375 samples = 4 value = [0, 1, 3, 0, 0] class = t 150->151 152 dst_host_serror_rate ≤ 0.015 gini = 0.133 samples = 14 value = [0, 1, 13, 0, 0] class = t 150->152 153 gini = 0.0 samples = 8 value = [0, 0, 8, 0, 0] class = t 152->153 154 same_srv_rate ≤ 0.185 gini = 0.278 samples = 6 value = [0, 1, 5, 0, 0] class = t 152->154 155 gini = 0.0 samples = 1 value = [0, 0, 1, 0, 0] class = t 154->155 156 same_srv_rate ≤ 0.21 gini = 0.32 samples = 5 value = [0, 1, 4, 0, 0] class = t 154->156 157 gini = 0.375 samples = 4 value = [0, 1, 3, 0, 0] class = t 156->157 158 gini = 0.0 samples = 1 value = [0, 0, 1, 0, 0] class = t 156->158 160 dst_host_serror_rate ≤ 0.015 gini = 0.408 samples = 7 value = [0, 5, 2, 0, 0] class = t 159->160 163 same_srv_rate ≤ 0.32 gini = 0.48 samples = 10 value = [0, 4, 6, 0, 0] class = t 159->163 161 gini = 0.444 samples = 6 value = [0, 4, 2, 0, 0] class = t 160->161 162 gini = 0.0 samples = 1 value = [0, 1, 0, 0, 0] class = t 160->162 164 gini = 0.0 samples = 2 value = [0, 0, 2, 0, 0] class = t 163->164 165 same_srv_rate ≤ 0.365 gini = 0.5 samples = 8 value = [0, 4, 4, 0, 0] class = t 163->165 166 dst_host_serror_rate ≤ 0.015 gini = 0.49 samples = 7 value = [0, 4, 3, 0, 0] class = t 165->166 169 gini = 0.0 samples = 1 value = [0, 0, 1, 0, 0] class = t 165->169 167 gini = 0.48 samples = 5 value = [0, 3, 2, 0, 0] class = t 166->167 168 gini = 0.5 samples = 2 value = [0, 1, 1, 0, 0] class = t 166->168 171 same_srv_rate ≤ 0.115 gini = 0.136 samples = 68 value = [0, 5, 63, 0, 0] class = t 170->171 192 dst_host_serror_rate ≤ 0.165 gini = 0.012 samples = 163 value = [0, 1, 162, 0, 0] class = t 170->192 172 gini = 0.0 samples = 30 value = [0, 0, 30, 0, 0] class = t 171->172 173 same_srv_rate ≤ 0.145 gini = 0.229 samples = 38 value = [0, 5, 33, 0, 0] class = t 171->173 174 same_srv_rate ≤ 0.125 gini = 0.32 samples = 10 value = [0, 2, 8, 0, 0] class = t 173->174 179 same_srv_rate ≤ 0.19 gini = 0.191 samples = 28 value = [0, 3, 25, 0, 0] class = t 173->179 175 gini = 0.375 samples = 4 value = [0, 1, 3, 0, 0] class = t 174->175 176 same_srv_rate ≤ 0.135 gini = 0.278 samples = 6 value = [0, 1, 5, 0, 0] class = t 174->176 177 gini = 0.0 samples = 1 value = [0, 0, 1, 0, 0] class = t 176->177 178 gini = 0.32 samples = 5 value = [0, 1, 4, 0, 0] class = t 176->178 180 gini = 0.0 samples = 5 value = [0, 0, 5, 0, 0] class = t 179->180 181 same_srv_rate ≤ 0.255 gini = 0.227 samples = 23 value = [0, 3, 20, 0, 0] class = t 179->181 182 same_srv_rate ≤ 0.24 gini = 0.32 samples = 10 value = [0, 2, 8, 0, 0] class = t 181->182 187 same_srv_rate ≤ 0.325 gini = 0.142 samples = 13 value = [0, 1, 12, 0, 0] class = t 181->187 183 same_srv_rate ≤ 0.205 gini = 0.219 samples = 8 value = [0, 1, 7, 0, 0] class = t 182->183 186 gini = 0.5 samples = 2 value = [0, 1, 1, 0, 0] class = t 182->186 184 gini = 0.375 samples = 4 value = [0, 1, 3, 0, 0] class = t 183->184 185 gini = 0.0 samples = 4 value = [0, 0, 4, 0, 0] class = t 183->185 188 gini = 0.0 samples = 8 value = [0, 0, 8, 0, 0] class = t 187->188 189 same_srv_rate ≤ 0.34 gini = 0.32 samples = 5 value = [0, 1, 4, 0, 0] class = t 187->189 190 gini = 0.5 samples = 2 value = [0, 1, 1, 0, 0] class = t 189->190 191 gini = 0.0 samples = 3 value = [0, 0, 3, 0, 0] class = t 189->191 193 gini = 0.0 samples = 159 value = [0, 0, 159, 0, 0] class = t 192->193 194 dst_host_serror_rate ≤ 0.185 gini = 0.375 samples = 4 value = [0, 1, 3, 0, 0] class = t 192->194 195 gini = 0.0 samples = 1 value = [0, 1, 0, 0, 0] class = t 194->195 196 gini = 0.0 samples = 3 value = [0, 0, 3, 0, 0] class = t 194->196 198 gini = 0.0 samples = 2 value = [0, 2, 0, 0, 0] class = t 197->198 199 dst_host_srv_serror_rate ≤ 0.04 gini = 0.444 samples = 3 value = [0, 2, 1, 0, 0] class = t 197->199 200 gini = 0.0 samples = 1 value = [0, 0, 1, 0, 0] class = t 199->200 201 gini = 0.0 samples = 2 value = [0, 2, 0, 0, 0] class = t 199->201 203 dst_host_serror_rate ≤ 0.065 gini = 0.072 samples = 161 value = [0, 155, 6, 0, 0] class = t 202->203 208 srv_serror_rate ≤ 0.25 gini = 0.379 samples = 112 value = [84, 1, 27, 0, 0] class = a 202->208 204 gini = 0.0 samples = 154 value = [0, 154, 0, 0, 0] class = t 203->204 205 dst_host_srv_serror_rate ≤ 0.54 gini = 0.245 samples = 7 value = [0, 1, 6, 0, 0] class = t 203->205 206 gini = 0.0 samples = 6 value = [0, 0, 6, 0, 0] class = t 205->206 207 gini = 0.0 samples = 1 value = [0, 1, 0, 0, 0] class = t 205->207 209 dst_host_serror_rate ≤ 0.2 gini = 0.026 samples = 77 value = [76, 1, 0, 0, 0] class = a 208->209 212 dst_host_serror_rate ≤ 0.475 gini = 0.353 samples = 35 value = [8, 0, 27, 0, 0] class = t 208->212 210 gini = 0.0 samples = 76 value = [76, 0, 0, 0, 0] class = a 209->210 211 gini = 0.0 samples = 1 value = [0, 1, 0, 0, 0] class = t 209->211 213 gini = 0.0 samples = 26 value = [0, 0, 26, 0, 0] class = t 212->213 214 same_srv_rate ≤ 0.195 gini = 0.198 samples = 9 value = [8, 0, 1, 0, 0] class = a 212->214 215 gini = 0.0 samples = 8 value = [8, 0, 0, 0, 0] class = a 214->215 216 gini = 0.0 samples = 1 value = [0, 0, 1, 0, 0] class = t 214->216 218 gini = 0.0 samples = 24 value = [0, 24, 0, 0, 0] class = t 217->218 219 serror_rate ≤ 0.455 gini = 0.0 samples = 26663 value = [26661, 0, 2, 0, 0] class = a 217->219 220 srv_serror_rate ≤ 0.75 gini = 0.444 samples = 3 value = [1, 0, 2, 0, 0] class = t 219->220 223 gini = 0.0 samples = 26660 value = [26660, 0, 0, 0, 0] class = a 219->223 221 gini = 0.0 samples = 1 value = [1, 0, 0, 0, 0] class = a 220->221 222 gini = 0.0 samples = 2 value = [0, 0, 2, 0, 0] class = t 220->222 225 dst_host_srv_serror_rate ≤ 0.99 gini = 0.304 samples = 63470 value = [3743, 52414, 6506, 768, 39] class = t 224->225 770 dst_host_srv_serror_rate ≤ 0.105 gini = 0.255 samples = 870 value = [746, 74, 47, 3, 0] class = a 224->770 226 same_srv_rate ≤ 0.945 gini = 0.301 samples = 63287 value = [3729, 52400, 6351, 768, 39] class = t 225->226 723 dst_host_serror_rate ≤ 0.025 gini = 0.271 samples = 183 value = [14, 14, 155, 0, 0] class = t 225->723 227 same_srv_rate ≤ 0.675 gini = 0.472 samples = 1704 value = [15, 1088, 591, 6, 4] class = t 226->227 362 dst_host_srv_serror_rate ≤ 0.005 gini = 0.293 samples = 61583 value = [3714, 51312, 5760, 762, 35] class = t 226->362 228 dst_host_serror_rate ≤ 0.025 gini = 0.414 samples = 1384 value = [6, 989, 380, 6, 3] class = t 227->228 311 same_srv_rate ≤ 0.745 gini = 0.469 samples = 320 value = [9, 99, 211, 0, 1] class = t 227->311 229 dst_host_srv_serror_rate ≤ 0.005 gini = 0.373 samples = 1268 value = [5, 960, 294, 6, 3] class = t 228->229 276 dst_host_serror_rate ≤ 0.585 gini = 0.388 samples = 116 value = [1, 29, 86, 0, 0] class = t 228->276 230 same_srv_rate ≤ 0.665 gini = 0.381 samples = 1214 value = [5, 909, 294, 3, 3] class = t 229->230 267 dst_host_serror_rate ≤ 0.015 gini = 0.105 samples = 54 value = [0, 51, 0, 3, 0] class = t 229->267 231 same_srv_rate ≤ 0.505 gini = 0.393 samples = 1096 value = [3, 806, 282, 3, 2] class = t 230->231 262 dst_host_serror_rate ≤ 0.005 gini = 0.227 samples = 118 value = [2, 103, 12, 0, 1] class = t 230->262 232 dst_host_serror_rate ≤ 0.005 gini = 0.364 samples = 1043 value = [2, 797, 239, 3, 2] class = t 231->232 241 same_srv_rate ≤ 0.625 gini = 0.313 samples = 53 value = [1, 9, 43, 0, 0] class = t 231->241 233 serror_rate ≤ 0.125 gini = 0.355 samples = 987 value = [2, 761, 221, 1, 2] class = t 232->233 236 serror_rate ≤ 0.25 gini = 0.482 samples = 56 value = [0, 36, 18, 2, 0] class = t 232->236 234 gini = 0.356 samples = 983 value = [2, 757, 221, 1, 2] class = t 233->234 235 gini = 0.0 samples = 4 value = [0, 4, 0, 0, 0] class = t 233->235 237 dst_host_serror_rate ≤ 0.015 gini = 0.487 samples = 55 value = [0, 35, 18, 2, 0] class = t 236->237 240 gini = 0.0 samples = 1 value = [0, 1, 0, 0, 0] class = t 236->240 238 gini = 0.464 samples = 44 value = [0, 29, 14, 1, 0] class = t 237->238 239 gini = 0.562 samples = 11 value = [0, 6, 4, 1, 0] class = t 237->239 242 same_srv_rate ≤ 0.595 gini = 0.393 samples = 39 value = [1, 9, 29, 0, 0] class = t 241->242 261 gini = 0.0 samples = 14 value = [0, 0, 14, 0, 0] class = t 241->261 243 same_srv_rate ≤ 0.525 gini = 0.288 samples = 24 value = [1, 3, 20, 0, 0] class = t 242->243 256 same_srv_rate ≤ 0.605 gini = 0.48 samples = 15 value = [0, 6, 9, 0, 0] class = t 242->256 244 gini = 0.0 samples = 4 value = [0, 0, 4, 0, 0] class = t 243->244 245 same_srv_rate ≤ 0.575 gini = 0.335 samples = 20 value = [1, 3, 16, 0, 0] class = t 243->245 246 same_srv_rate ≤ 0.565 gini = 0.381 samples = 17 value = [1, 3, 13, 0, 0] class = t 245->246 255 gini = 0.0 samples = 3 value = [0, 0, 3, 0, 0] class = t 245->255 247 same_srv_rate ≤ 0.555 gini = 0.338 samples = 15 value = [1, 2, 12, 0, 0] class = t 246->247 254 gini = 0.5 samples = 2 value = [0, 1, 1, 0, 0] class = t 246->254 248 same_srv_rate ≤ 0.545 gini = 0.43 samples = 11 value = [1, 2, 8, 0, 0] class = t 247->248 253 gini = 0.0 samples = 4 value = [0, 0, 4, 0, 0] class = t 247->253 249 same_srv_rate ≤ 0.535 gini = 0.37 samples = 9 value = [1, 1, 7, 0, 0] class = t 248->249 252 gini = 0.5 samples = 2 value = [0, 1, 1, 0, 0] class = t 248->252 250 gini = 0.449 samples = 7 value = [1, 1, 5, 0, 0] class = t 249->250 251 gini = 0.0 samples = 2 value = [0, 0, 2, 0, 0] class = t 249->251 257 gini = 0.469 samples = 8 value = [0, 5, 3, 0, 0] class = t 256->257 258 same_srv_rate ≤ 0.615 gini = 0.245 samples = 7 value = [0, 1, 6, 0, 0] class = t 256->258 259 gini = 0.0 samples = 2 value = [0, 0, 2, 0, 0] class = t 258->259 260 gini = 0.32 samples = 5 value = [0, 1, 4, 0, 0] class = t 258->260 263 gini = 0.205 samples = 115 value = [2, 102, 10, 0, 1] class = t 262->263 264 dst_host_serror_rate ≤ 0.015 gini = 0.444 samples = 3 value = [0, 1, 2, 0, 0] class = t 262->264 265 gini = 0.5 samples = 2 value = [0, 1, 1, 0, 0] class = t 264->265 266 gini = 0.0 samples = 1 value = [0, 0, 1, 0, 0] class = t 264->266 268 gini = 0.0 samples = 47 value = [0, 47, 0, 0, 0] class = t 267->268 269 srv_serror_rate ≤ 0.25 gini = 0.49 samples = 7 value = [0, 4, 0, 3, 0] class = t 267->269 270 dst_host_srv_serror_rate ≤ 0.035 gini = 0.375 samples = 4 value = [0, 1, 0, 3, 0] class = a 269->270 275 gini = 0.0 samples = 3 value = [0, 3, 0, 0, 0] class = t 269->275 271 dst_host_srv_serror_rate ≤ 0.015 gini = 0.5 samples = 2 value = [0, 1, 0, 1, 0] class = t 270->271 274 gini = 0.0 samples = 2 value = [0, 0, 0, 2, 0] class = a 270->274 272 gini = 0.0 samples = 1 value = [0, 0, 0, 1, 0] class = a 271->272 273 gini = 0.0 samples = 1 value = [0, 1, 0, 0, 0] class = t 271->273 277 dst_host_srv_serror_rate ≤ 0.035 gini = 0.228 samples = 99 value = [0, 13, 86, 0, 0] class = t 276->277 308 serror_rate ≤ 0.75 gini = 0.111 samples = 17 value = [1, 16, 0, 0, 0] class = t 276->308 278 dst_host_serror_rate ≤ 0.205 gini = 0.172 samples = 95 value = [0, 9, 86, 0, 0] class = t 277->278 307 gini = 0.0 samples = 4 value = [0, 4, 0, 0, 0] class = t 277->307 279 dst_host_serror_rate ≤ 0.035 gini = 0.108 samples = 70 value = [0, 4, 66, 0, 0] class = t 278->279 292 same_srv_rate ≤ 0.585 gini = 0.32 samples = 25 value = [0, 5, 20, 0, 0] class = t 278->292 280 same_srv_rate ≤ 0.53 gini = 0.32 samples = 15 value = [0, 3, 12, 0, 0] class = t 279->280 285 dst_host_serror_rate ≤ 0.17 gini = 0.036 samples = 55 value = [0, 1, 54, 0, 0] class = t 279->285 281 serror_rate ≤ 0.25 gini = 0.49 samples = 7 value = [0, 3, 4, 0, 0] class = t 280->281 284 gini = 0.0 samples = 8 value = [0, 0, 8, 0, 0] class = t 280->284 282 gini = 0.5 samples = 6 value = [0, 3, 3, 0, 0] class = t 281->282 283 gini = 0.0 samples = 1 value = [0, 0, 1, 0, 0] class = t 281->283 286 gini = 0.0 samples = 45 value = [0, 0, 45, 0, 0] class = t 285->286 287 dst_host_serror_rate ≤ 0.185 gini = 0.18 samples = 10 value = [0, 1, 9, 0, 0] class = t 285->287 288 same_srv_rate ≤ 0.585 gini = 0.375 samples = 4 value = [0, 1, 3, 0, 0] class = t 287->288 291 gini = 0.0 samples = 6 value = [0, 0, 6, 0, 0] class = t 287->291 289 gini = 0.444 samples = 3 value = [0, 1, 2, 0, 0] class = t 288->289 290 gini = 0.0 samples = 1 value = [0, 0, 1, 0, 0] class = t 288->290 293 dst_host_serror_rate ≤ 0.225 gini = 0.227 samples = 23 value = [0, 3, 20, 0, 0] class = t 292->293 306 gini = 0.0 samples = 2 value = [0, 2, 0, 0, 0] class = t 292->306 294 dst_host_serror_rate ≤ 0.215 gini = 0.375 samples = 4 value = [0, 1, 3, 0, 0] class = t 293->294 297 dst_host_serror_rate ≤ 0.355 gini = 0.188 samples = 19 value = [0, 2, 17, 0, 0] class = t 293->297 295 gini = 0.0 samples = 2 value = [0, 0, 2, 0, 0] class = t 294->295 296 gini = 0.5 samples = 2 value = [0, 1, 1, 0, 0] class = t 294->296 298 dst_host_serror_rate ≤ 0.255 gini = 0.124 samples = 15 value = [0, 1, 14, 0, 0] class = t 297->298 303 dst_host_serror_rate ≤ 0.4 gini = 0.375 samples = 4 value = [0, 1, 3, 0, 0] class = t 297->303 299 dst_host_serror_rate ≤ 0.245 gini = 0.245 samples = 7 value = [0, 1, 6, 0, 0] class = t 298->299 302 gini = 0.0 samples = 8 value = [0, 0, 8, 0, 0] class = t 298->302 300 gini = 0.0 samples = 5 value = [0, 0, 5, 0, 0] class = t 299->300 301 gini = 0.5 samples = 2 value = [0, 1, 1, 0, 0] class = t 299->301 304 gini = 0.0 samples = 1 value = [0, 1, 0, 0, 0] class = t 303->304 305 gini = 0.0 samples = 3 value = [0, 0, 3, 0, 0] class = t 303->305 309 gini = 0.0 samples = 16 value = [0, 16, 0, 0, 0] class = t 308->309 310 gini = 0.0 samples = 1 value = [1, 0, 0, 0, 0] class = a 308->310 312 same_srv_rate ≤ 0.715 gini = 0.137 samples = 54 value = [4, 0, 50, 0, 0] class = t 311->312 321 same_srv_rate ≤ 0.835 gini = 0.495 samples = 266 value = [5, 99, 161, 0, 1] class = t 311->321 313 gini = 0.0 samples = 28 value = [0, 0, 28, 0, 0] class = t 312->313 314 dst_host_serror_rate ≤ 0.01 gini = 0.26 samples = 26 value = [4, 0, 22, 0, 0] class = t 312->314 315 same_srv_rate ≤ 0.735 gini = 0.332 samples = 19 value = [4, 0, 15, 0, 0] class = t 314->315 320 gini = 0.0 samples = 7 value = [0, 0, 7, 0, 0] class = t 314->320 316 same_srv_rate ≤ 0.725 gini = 0.397 samples = 11 value = [3, 0, 8, 0, 0] class = t 315->316 319 gini = 0.219 samples = 8 value = [1, 0, 7, 0, 0] class = t 315->319 317 gini = 0.278 samples = 6 value = [1, 0, 5, 0, 0] class = t 316->317 318 gini = 0.48 samples = 5 value = [2, 0, 3, 0, 0] class = t 316->318 322 dst_host_serror_rate ≤ 0.015 gini = 0.55 samples = 93 value = [5, 50, 37, 0, 1] class = t 321->322 337 dst_host_srv_serror_rate ≤ 0.01 gini = 0.406 samples = 173 value = [0, 49, 124, 0, 0] class = t 321->337 323 same_srv_rate ≤ 0.785 gini = 0.487 samples = 75 value = [5, 50, 19, 0, 1] class = t 322->323 336 gini = 0.0 samples = 18 value = [0, 0, 18, 0, 0] class = t 322->336 324 same_srv_rate ≤ 0.755 gini = 0.579 samples = 31 value = [2, 16, 12, 0, 1] class = t 323->324 329 same_srv_rate ≤ 0.81 gini = 0.373 samples = 44 value = [3, 34, 7, 0, 0] class = t 323->329 325 gini = 0.573 samples = 27 value = [2, 15, 9, 0, 1] class = t 324->325 326 same_srv_rate ≤ 0.77 gini = 0.375 samples = 4 value = [0, 1, 3, 0, 0] class = t 324->326 327 gini = 0.0 samples = 2 value = [0, 0, 2, 0, 0] class = t 326->327 328 gini = 0.5 samples = 2 value = [0, 1, 1, 0, 0] class = t 326->328 330 same_srv_rate ≤ 0.795 gini = 0.322 samples = 21 value = [3, 17, 1, 0, 0] class = t 329->330 333 same_srv_rate ≤ 0.825 gini = 0.386 samples = 23 value = [0, 17, 6, 0, 0] class = t 329->333 331 gini = 0.0 samples = 1 value = [0, 1, 0, 0, 0] class = t 330->331 332 gini = 0.335 samples = 20 value = [3, 16, 1, 0, 0] class = t 330->332 334 gini = 0.5 samples = 2 value = [0, 1, 1, 0, 0] class = t 333->334 335 gini = 0.363 samples = 21 value = [0, 16, 5, 0, 0] class = t 333->335 338 dst_host_serror_rate ≤ 0.045 gini = 0.395 samples = 170 value = [0, 46, 124, 0, 0] class = t 337->338 361 gini = 0.0 samples = 3 value = [0, 3, 0, 0, 0] class = t 337->361 339 same_srv_rate ≤ 0.855 gini = 0.419 samples = 154 value = [0, 46, 108, 0, 0] class = t 338->339 360 gini = 0.0 samples = 16 value = [0, 0, 16, 0, 0] class = t 338->360 340 gini = 0.0 samples = 14 value = [0, 0, 14, 0, 0] class = t 339->340 341 same_srv_rate ≤ 0.865 gini = 0.441 samples = 140 value = [0, 46, 94, 0, 0] class = t 339->341 342 gini = 0.486 samples = 24 value = [0, 14, 10, 0, 0] class = t 341->342 343 dst_host_serror_rate ≤ 0.02 gini = 0.4 samples = 116 value = [0, 32, 84, 0, 0] class = t 341->343 344 same_srv_rate ≤ 0.925 gini = 0.388 samples = 114 value = [0, 30, 84, 0, 0] class = t 343->344 359 gini = 0.0 samples = 2 value = [0, 2, 0, 0, 0] class = t 343->359 345 same_srv_rate ≤ 0.875 gini = 0.331 samples = 86 value = [0, 18, 68, 0, 0] class = t 344->345 356 same_srv_rate ≤ 0.935 gini = 0.49 samples = 28 value = [0, 12, 16, 0, 0] class = t 344->356 346 gini = 0.0 samples = 11 value = [0, 0, 11, 0, 0] class = t 345->346 347 same_srv_rate ≤ 0.905 gini = 0.365 samples = 75 value = [0, 18, 57, 0, 0] class = t 345->347 348 same_srv_rate ≤ 0.895 gini = 0.463 samples = 33 value = [0, 12, 21, 0, 0] class = t 347->348 353 same_srv_rate ≤ 0.915 gini = 0.245 samples = 42 value = [0, 6, 36, 0, 0] class = t 347->353 349 same_srv_rate ≤ 0.885 gini = 0.469 samples = 24 value = [0, 9, 15, 0, 0] class = t 348->349 352 gini = 0.444 samples = 9 value = [0, 3, 6, 0, 0] class = t 348->352 350 gini = 0.457 samples = 17 value = [0, 6, 11, 0, 0] class = t 349->350 351 gini = 0.49 samples = 7 value = [0, 3, 4, 0, 0] class = t 349->351 354 gini = 0.117 samples = 16 value = [0, 1, 15, 0, 0] class = t 353->354 355 gini = 0.311 samples = 26 value = [0, 5, 21, 0, 0] class = t 353->355 357 gini = 0.457 samples = 17 value = [0, 6, 11, 0, 0] class = t 356->357 358 gini = 0.496 samples = 11 value = [0, 6, 5, 0, 0] class = t 356->358 363 dst_host_serror_rate ≤ 0.015 gini = 0.305 samples = 57132 value = [3564, 47137, 5755, 642, 34] class = t 362->363 516 dst_host_serror_rate ≤ 0.915 gini = 0.118 samples = 4451 value = [150, 4175, 5, 120, 1] class = t 362->516 364 same_srv_rate ≤ 0.985 gini = 0.295 samples = 55316 value = [3152, 45989, 5560, 581, 34] class = t 363->364 407 dst_host_serror_rate ≤ 0.245 gini = 0.536 samples = 1816 value = [412, 1148, 195, 61, 0] class = t 363->407 365 serror_rate ≤ 0.005 gini = 0.495 samples = 131 value = [59, 72, 0, 0, 0] class = t 364->365 374 srv_serror_rate ≤ 0.005 gini = 0.294 samples = 55185 value = [3093, 45917, 5560, 581, 34] class = t 364->374 366 same_srv_rate ≤ 0.965 gini = 0.426 samples = 104 value = [32, 72, 0, 0, 0] class = t 365->366 373 gini = 0.0 samples = 27 value = [27, 0, 0, 0, 0] class = a 365->373 367 same_srv_rate ≤ 0.955 gini = 0.375 samples = 16 value = [4, 12, 0, 0, 0] class = t 366->367 370 same_srv_rate ≤ 0.975 gini = 0.434 samples = 88 value = [28, 60, 0, 0, 0] class = t 366->370 368 gini = 0.32 samples = 5 value = [1, 4, 0, 0, 0] class = t 367->368 369 gini = 0.397 samples = 11 value = [3, 8, 0, 0, 0] class = t 367->369 371 gini = 0.43 samples = 32 value = [10, 22, 0, 0, 0] class = t 370->371 372 gini = 0.436 samples = 56 value = [18, 38, 0, 0, 0] class = t 370->372 375 serror_rate ≤ 0.005 gini = 0.298 samples = 54407 value = [3087, 45145, 5560, 581, 34] class = t 374->375 382 serror_rate ≤ 0.155 gini = 0.015 samples = 778 value = [6, 772, 0, 0, 0] class = t 374->382 376 same_srv_rate ≤ 0.995 gini = 0.297 samples = 54381 value = [3061, 45145, 5560, 581, 34] class = t 375->376 381 gini = 0.0 samples = 26 value = [26, 0, 0, 0, 0] class = a 375->381 377 gini = 0.01 samples = 589 value = [3, 586, 0, 0, 0] class = t 376->377 378 dst_host_serror_rate ≤ 0.005 gini = 0.3 samples = 53792 value = [3058, 44559, 5560, 581, 34] class = t 376->378 379 gini = 0.298 samples = 52818 value = [2888, 43796, 5545, 555, 34] class = t 378->379 380 gini = 0.355 samples = 974 value = [170, 763, 15, 26, 0] class = t 378->380 383 gini = 0.0 samples = 412 value = [0, 412, 0, 0, 0] class = t 382->383 384 dst_host_serror_rate ≤ 0.005 gini = 0.032 samples = 366 value = [6, 360, 0, 0, 0] class = t 382->384 385 serror_rate ≤ 0.29 gini = 0.043 samples = 273 value = [6, 267, 0, 0, 0] class = t 384->385 406 gini = 0.0 samples = 93 value = [0, 93, 0, 0, 0] class = t 384->406 386 srv_serror_rate ≤ 0.235 gini = 0.057 samples = 137 value = [4, 133, 0, 0, 0] class = t 385->386 399 srv_serror_rate ≤ 0.45 gini = 0.029 samples = 136 value = [2, 134, 0, 0, 0] class = t 385->399 387 serror_rate ≤ 0.21 gini = 0.042 samples = 94 value = [2, 92, 0, 0, 0] class = t 386->387 396 serror_rate ≤ 0.225 gini = 0.089 samples = 43 value = [2, 41, 0, 0, 0] class = t 386->396 388 srv_serror_rate ≤ 0.15 gini = 0.048 samples = 82 value = [2, 80, 0, 0, 0] class = t 387->388 395 gini = 0.0 samples = 12 value = [0, 12, 0, 0, 0] class = t 387->395 389 gini = 0.0 samples = 5 value = [0, 5, 0, 0, 0] class = t 388->389 390 srv_serror_rate ≤ 0.175 gini = 0.051 samples = 77 value = [2, 75, 0, 0, 0] class = t 388->390 391 gini = 0.059 samples = 33 value = [1, 32, 0, 0, 0] class = t 390->391 392 serror_rate ≤ 0.19 gini = 0.044 samples = 44 value = [1, 43, 0, 0, 0] class = t 390->392 393 gini = 0.0 samples = 1 value = [0, 1, 0, 0, 0] class = t 392->393 394 gini = 0.045 samples = 43 value = [1, 42, 0, 0, 0] class = t 392->394 397 gini = 0.0 samples = 1 value = [0, 1, 0, 0, 0] class = t 396->397 398 gini = 0.091 samples = 42 value = [2, 40, 0, 0, 0] class = t 396->398 400 gini = 0.0 samples = 80 value = [0, 80, 0, 0, 0] class = t 399->400 401 serror_rate ≤ 0.75 gini = 0.069 samples = 56 value = [2, 54, 0, 0, 0] class = t 399->401 402 serror_rate ≤ 0.415 gini = 0.105 samples = 36 value = [2, 34, 0, 0, 0] class = t 401->402 405 gini = 0.0 samples = 20 value = [0, 20, 0, 0, 0] class = t 401->405 403 gini = 0.0 samples = 1 value = [0, 1, 0, 0, 0] class = t 402->403 404 gini = 0.108 samples = 35 value = [2, 33, 0, 0, 0] class = t 402->404 408 srv_serror_rate ≤ 0.005 gini = 0.641 samples = 1187 value = [350, 585, 192, 60, 0] class = t 407->408 455 dst_host_serror_rate ≤ 0.615 gini = 0.189 samples = 629 value = [62, 563, 3, 1, 0] class = t 407->455 409 dst_host_serror_rate ≤ 0.025 gini = 0.676 samples = 1018 value = [350, 416, 192, 60, 0] class = t 408->409 454 gini = 0.0 samples = 169 value = [0, 169, 0, 0, 0] class = t 408->454 410 gini = 0.563 samples = 405 value = [181, 196, 8, 20, 0] class = t 409->410 411 dst_host_serror_rate ≤ 0.085 gini = 0.701 samples = 613 value = [169, 220, 184, 40, 0] class = t 409->411 412 dst_host_serror_rate ≤ 0.035 gini = 0.625 samples = 363 value = [44, 164, 143, 12, 0] class = t 411->412 423 dst_host_serror_rate ≤ 0.095 gini = 0.66 samples = 250 value = [125, 56, 41, 28, 0] class = a 411->423 413 gini = 0.599 samples = 156 value = [21, 82, 51, 2, 0] class = t 412->413 414 dst_host_serror_rate ≤ 0.065 gini = 0.631 samples = 207 value = [23, 82, 92, 10, 0] class = t 412->414 415 dst_host_serror_rate ≤ 0.055 gini = 0.608 samples = 158 value = [14, 60, 77, 7, 0] class = t 414->415 420 dst_host_serror_rate ≤ 0.075 gini = 0.667 samples = 49 value = [9, 22, 15, 3, 0] class = t 414->420 416 dst_host_serror_rate ≤ 0.045 gini = 0.604 samples = 122 value = [11, 45, 61, 5, 0] class = t 415->416 419 gini = 0.619 samples = 36 value = [3, 15, 16, 2, 0] class = t 415->419 417 gini = 0.594 samples = 69 value = [5, 26, 35, 3, 0] class = t 416->417 418 gini = 0.617 samples = 53 value = [6, 19, 26, 2, 0] class = t 416->418 421 gini = 0.685 samples = 29 value = [6, 12, 9, 2, 0] class = t 420->421 422 gini = 0.635 samples = 20 value = [3, 10, 6, 1, 0] class = t 420->422 424 gini = 0.28 samples = 83 value = [70, 4, 6, 3, 0] class = a 423->424 425 dst_host_serror_rate ≤ 0.165 gini = 0.728 samples = 167 value = [55, 52, 35, 25, 0] class = a 423->425 426 dst_host_serror_rate ≤ 0.125 gini = 0.733 samples = 108 value = [26, 35, 31, 16, 0] class = t 425->426 439 dst_host_serror_rate ≤ 0.225 gini = 0.648 samples = 59 value = [29, 17, 4, 9, 0] class = a 425->439 427 dst_host_serror_rate ≤ 0.105 gini = 0.689 samples = 51 value = [10, 23, 12, 6, 0] class = t 426->427 432 dst_host_serror_rate ≤ 0.135 gini = 0.735 samples = 57 value = [16, 12, 19, 10, 0] class = t 426->432 428 gini = 0.658 samples = 15 value = [1, 6, 6, 2, 0] class = t 427->428 429 dst_host_serror_rate ≤ 0.115 gini = 0.674 samples = 36 value = [9, 17, 6, 4, 0] class = t 427->429 430 gini = 0.649 samples = 22 value = [6, 11, 3, 2, 0] class = t 429->430 431 gini = 0.704 samples = 14 value = [3, 6, 3, 2, 0] class = t 429->431 433 gini = 0.639 samples = 21 value = [5, 2, 11, 3, 0] class = t 432->433 434 dst_host_serror_rate ≤ 0.155 gini = 0.742 samples = 36 value = [11, 10, 8, 7, 0] class = a 432->434 435 dst_host_serror_rate ≤ 0.145 gini = 0.656 samples = 16 value = [6, 6, 0, 4, 0] class = a 434->435 438 gini = 0.715 samples = 20 value = [5, 4, 8, 3, 0] class = t 434->438 436 gini = 0.656 samples = 8 value = [3, 3, 0, 2, 0] class = a 435->436 437 gini = 0.656 samples = 8 value = [3, 3, 0, 2, 0] class = a 435->437 440 dst_host_serror_rate ≤ 0.205 gini = 0.627 samples = 44 value = [24, 7, 4, 9, 0] class = a 439->440 451 dst_host_serror_rate ≤ 0.235 gini = 0.444 samples = 15 value = [5, 10, 0, 0, 0] class = t 439->451 441 dst_host_serror_rate ≤ 0.195 gini = 0.593 samples = 35 value = [20, 7, 1, 7, 0] class = a 440->441 448 dst_host_serror_rate ≤ 0.215 gini = 0.642 samples = 9 value = [4, 0, 3, 2, 0] class = a 440->448 442 dst_host_serror_rate ≤ 0.175 gini = 0.654 samples = 23 value = [11, 6, 1, 5, 0] class = a 441->442 447 gini = 0.403 samples = 12 value = [9, 1, 0, 2, 0] class = a 441->447 443 gini = 0.656 samples = 8 value = [4, 2, 1, 1, 0] class = a 442->443 444 dst_host_serror_rate ≤ 0.185 gini = 0.64 samples = 15 value = [7, 4, 0, 4, 0] class = a 442->444 445 gini = 0.625 samples = 8 value = [4, 2, 0, 2, 0] class = a 444->445 446 gini = 0.653 samples = 7 value = [3, 2, 0, 2, 0] class = a 444->446 449 gini = 0.64 samples = 5 value = [2, 0, 2, 1, 0] class = a 448->449 450 gini = 0.625 samples = 4 value = [2, 0, 1, 1, 0] class = a 448->450 452 gini = 0.48 samples = 5 value = [2, 3, 0, 0, 0] class = t 451->452 453 gini = 0.42 samples = 10 value = [3, 7, 0, 0, 0] class = t 451->453 456 srv_serror_rate ≤ 0.02 gini = 0.283 samples = 392 value = [62, 326, 3, 1, 0] class = t 455->456 515 gini = 0.0 samples = 237 value = [0, 237, 0, 0, 0] class = t 455->515 457 dst_host_serror_rate ≤ 0.395 gini = 0.327 samples = 327 value = [62, 261, 3, 1, 0] class = t 456->457 514 gini = 0.0 samples = 65 value = [0, 65, 0, 0, 0] class = t 456->514 458 dst_host_serror_rate ≤ 0.285 gini = 0.394 samples = 141 value = [35, 104, 1, 1, 0] class = t 457->458 487 dst_host_serror_rate ≤ 0.535 gini = 0.266 samples = 186 value = [27, 157, 2, 0, 0] class = t 457->487 459 dst_host_serror_rate ≤ 0.255 gini = 0.332 samples = 49 value = [9, 39, 1, 0, 0] class = t 458->459 466 dst_host_serror_rate ≤ 0.305 gini = 0.421 samples = 92 value = [26, 65, 0, 1, 0] class = t 458->466 460 gini = 0.371 samples = 30 value = [6, 23, 1, 0, 0] class = t 459->460 461 dst_host_serror_rate ≤ 0.275 gini = 0.266 samples = 19 value = [3, 16, 0, 0, 0] class = t 459->461 462 dst_host_serror_rate ≤ 0.265 gini = 0.245 samples = 14 value = [2, 12, 0, 0, 0] class = t 461->462 465 gini = 0.32 samples = 5 value = [1, 4, 0, 0, 0] class = t 461->465 463 gini = 0.245 samples = 7 value = [1, 6, 0, 0, 0] class = t 462->463 464 gini = 0.245 samples = 7 value = [1, 6, 0, 0, 0] class = t 462->464 467 dst_host_serror_rate ≤ 0.295 gini = 0.496 samples = 11 value = [5, 6, 0, 0, 0] class = t 466->467 470 dst_host_serror_rate ≤ 0.335 gini = 0.402 samples = 81 value = [21, 59, 0, 1, 0] class = t 466->470 468 gini = 0.49 samples = 7 value = [3, 4, 0, 0, 0] class = t 467->468 469 gini = 0.5 samples = 4 value = [2, 2, 0, 0, 0] class = a 467->469 471 dst_host_serror_rate ≤ 0.315 gini = 0.343 samples = 41 value = [9, 32, 0, 0, 0] class = t 470->471 476 dst_host_serror_rate ≤ 0.385 gini = 0.454 samples = 40 value = [12, 27, 0, 1, 0] class = t 470->476 472 gini = 0.444 samples = 9 value = [3, 6, 0, 0, 0] class = t 471->472 473 dst_host_serror_rate ≤ 0.325 gini = 0.305 samples = 32 value = [6, 26, 0, 0, 0] class = t 471->473 474 gini = 0.375 samples = 4 value = [1, 3, 0, 0, 0] class = t 473->474 475 gini = 0.293 samples = 28 value = [5, 23, 0, 0, 0] class = t 473->475 477 dst_host_serror_rate ≤ 0.365 gini = 0.444 samples = 33 value = [11, 22, 0, 0, 0] class = t 476->477 486 gini = 0.449 samples = 7 value = [1, 5, 0, 1, 0] class = t 476->486 478 dst_host_serror_rate ≤ 0.355 gini = 0.469 samples = 16 value = [6, 10, 0, 0, 0] class = t 477->478 483 dst_host_serror_rate ≤ 0.375 gini = 0.415 samples = 17 value = [5, 12, 0, 0, 0] class = t 477->483 479 dst_host_serror_rate ≤ 0.345 gini = 0.42 samples = 10 value = [3, 7, 0, 0, 0] class = t 478->479 482 gini = 0.5 samples = 6 value = [3, 3, 0, 0, 0] class = a 478->482 480 gini = 0.444 samples = 3 value = [1, 2, 0, 0, 0] class = t 479->480 481 gini = 0.408 samples = 7 value = [2, 5, 0, 0, 0] class = t 479->481 484 gini = 0.408 samples = 7 value = [2, 5, 0, 0, 0] class = t 483->484 485 gini = 0.42 samples = 10 value = [3, 7, 0, 0, 0] class = t 483->485 488 dst_host_serror_rate ≤ 0.495 gini = 0.165 samples = 123 value = [9, 112, 2, 0, 0] class = t 487->488 499 dst_host_serror_rate ≤ 0.545 gini = 0.408 samples = 63 value = [18, 45, 0, 0, 0] class = t 487->499 489 dst_host_serror_rate ≤ 0.415 gini = 0.074 samples = 78 value = [3, 75, 0, 0, 0] class = t 488->489 494 dst_host_serror_rate ≤ 0.505 gini = 0.304 samples = 45 value = [6, 37, 2, 0, 0] class = t 488->494 490 dst_host_serror_rate ≤ 0.405 gini = 0.305 samples = 16 value = [3, 13, 0, 0, 0] class = t 489->490 493 gini = 0.0 samples = 62 value = [0, 62, 0, 0, 0] class = t 489->493 491 gini = 0.298 samples = 11 value = [2, 9, 0, 0, 0] class = t 490->491 492 gini = 0.32 samples = 5 value = [1, 4, 0, 0, 0] class = t 490->492 495 gini = 0.444 samples = 15 value = [5, 10, 0, 0, 0] class = t 494->495 496 dst_host_serror_rate ≤ 0.525 gini = 0.184 samples = 30 value = [1, 27, 2, 0, 0] class = t 494->496 497 gini = 0.0 samples = 15 value = [0, 15, 0, 0, 0] class = t 496->497 498 gini = 0.338 samples = 15 value = [1, 12, 2, 0, 0] class = t 496->498 500 gini = 0.32 samples = 5 value = [1, 4, 0, 0, 0] class = t 499->500 501 dst_host_serror_rate ≤ 0.605 gini = 0.414 samples = 58 value = [17, 41, 0, 0, 0] class = t 499->501 502 dst_host_serror_rate ≤ 0.575 gini = 0.422 samples = 53 value = [16, 37, 0, 0, 0] class = t 501->502 513 gini = 0.32 samples = 5 value = [1, 4, 0, 0, 0] class = t 501->513 503 dst_host_serror_rate ≤ 0.565 gini = 0.4 samples = 29 value = [8, 21, 0, 0, 0] class = t 502->503 508 dst_host_serror_rate ≤ 0.585 gini = 0.444 samples = 24 value = [8, 16, 0, 0, 0] class = t 502->508 504 dst_host_serror_rate ≤ 0.555 gini = 0.408 samples = 21 value = [6, 15, 0, 0, 0] class = t 503->504 507 gini = 0.375 samples = 8 value = [2, 6, 0, 0, 0] class = t 503->507 505 gini = 0.397 samples = 11 value = [3, 8, 0, 0, 0] class = t 504->505 506 gini = 0.42 samples = 10 value = [3, 7, 0, 0, 0] class = t 504->506 509 gini = 0.49 samples = 7 value = [3, 4, 0, 0, 0] class = t 508->509 510 dst_host_serror_rate ≤ 0.595 gini = 0.415 samples = 17 value = [5, 12, 0, 0, 0] class = t 508->510 511 gini = 0.408 samples = 7 value = [2, 5, 0, 0, 0] class = t 510->511 512 gini = 0.42 samples = 10 value = [3, 7, 0, 0, 0] class = t 510->512 517 dst_host_srv_serror_rate ≤ 0.015 gini = 0.108 samples = 4406 value = [123, 4158, 4, 120, 1] class = t 516->517 712 serror_rate ≤ 0.5 gini = 0.497 samples = 45 value = [27, 17, 1, 0, 0] class = a 516->712 518 dst_host_serror_rate ≤ 0.005 gini = 0.059 samples = 2942 value = [81, 2853, 1, 7, 0] class = t 517->518 549 dst_host_srv_serror_rate ≤ 0.075 gini = 0.199 samples = 1464 value = [42, 1305, 3, 113, 1] class = t 517->549 519 srv_serror_rate ≤ 0.015 gini = 0.001 samples = 1451 value = [0, 1450, 1, 0, 0] class = t 518->519 524 dst_host_serror_rate ≤ 0.015 gini = 0.112 samples = 1491 value = [81, 1403, 0, 7, 0] class = t 518->524 520 same_srv_rate ≤ 0.975 gini = 0.001 samples = 1413 value = [0, 1412, 1, 0, 0] class = t 519->520 523 gini = 0.0 samples = 38 value = [0, 38, 0, 0, 0] class = t 519->523 521 gini = 0.0 samples = 1 value = [0, 1, 0, 0, 0] class = t 520->521 522 gini = 0.001 samples = 1412 value = [0, 1411, 1, 0, 0] class = t 520->522 525 srv_serror_rate ≤ 0.01 gini = 0.15 samples = 1046 value = [81, 961, 0, 4, 0] class = t 524->525 544 dst_host_serror_rate ≤ 0.025 gini = 0.013 samples = 445 value = [0, 442, 0, 3, 0] class = t 524->544 526 gini = 0.182 samples = 803 value = [77, 722, 0, 4, 0] class = t 525->526 527 srv_serror_rate ≤ 0.465 gini = 0.032 samples = 243 value = [4, 239, 0, 0, 0] class = t 525->527 528 serror_rate ≤ 0.21 gini = 0.012 samples = 170 value = [1, 169, 0, 0, 0] class = t 527->528 537 serror_rate ≤ 0.75 gini = 0.079 samples = 73 value = [3, 70, 0, 0, 0] class = t 527->537 529 serror_rate ≤ 0.19 gini = 0.025 samples = 80 value = [1, 79, 0, 0, 0] class = t 528->529 536 gini = 0.0 samples = 90 value = [0, 90, 0, 0, 0] class = t 528->536 530 gini = 0.0 samples = 64 value = [0, 64, 0, 0, 0] class = t 529->530 531 srv_serror_rate ≤ 0.19 gini = 0.117 samples = 16 value = [1, 15, 0, 0, 0] class = t 529->531 532 gini = 0.0 samples = 3 value = [0, 3, 0, 0, 0] class = t 531->532 533 srv_serror_rate ≤ 0.21 gini = 0.142 samples = 13 value = [1, 12, 0, 0, 0] class = t 531->533 534 gini = 0.18 samples = 10 value = [1, 9, 0, 0, 0] class = t 533->534 535 gini = 0.0 samples = 3 value = [0, 3, 0, 0, 0] class = t 533->535 538 serror_rate ≤ 0.415 gini = 0.117 samples = 48 value = [3, 45, 0, 0, 0] class = t 537->538 543 gini = 0.0 samples = 25 value = [0, 25, 0, 0, 0] class = t 537->543 539 gini = 0.0 samples = 3 value = [0, 3, 0, 0, 0] class = t 538->539 540 srv_serror_rate ≤ 0.585 gini = 0.124 samples = 45 value = [3, 42, 0, 0, 0] class = t 538->540 541 gini = 0.127 samples = 44 value = [3, 41, 0, 0, 0] class = t 540->541 542 gini = 0.0 samples = 1 value = [0, 1, 0, 0, 0] class = t 540->542 545 srv_serror_rate ≤ 0.01 gini = 0.043 samples = 136 value = [0, 133, 0, 3, 0] class = t 544->545 548 gini = 0.0 samples = 309 value = [0, 309, 0, 0, 0] class = t 544->548 546 gini = 0.061 samples = 96 value = [0, 93, 0, 3, 0] class = t 545->546 547 gini = 0.0 samples = 40 value = [0, 40, 0, 0, 0] class = t 545->547 550 dst_host_serror_rate ≤ 0.035 gini = 0.26 samples = 809 value = [25, 689, 2, 93, 0] class = t 549->550 645 srv_serror_rate ≤ 0.54 gini = 0.114 samples = 655 value = [17, 616, 1, 20, 1] class = t 549->645 551 dst_host_serror_rate ≤ 0.005 gini = 0.211 samples = 689 value = [24, 609, 1, 55, 0] class = t 550->551 604 srv_serror_rate ≤ 0.035 gini = 0.455 samples = 120 value = [1, 80, 1, 38, 0] class = t 550->604 552 dst_host_srv_serror_rate ≤ 0.045 gini = 0.273 samples = 290 value = [0, 243, 1, 46, 0] class = t 551->552 567 dst_host_serror_rate ≤ 0.015 gini = 0.154 samples = 399 value = [24, 366, 0, 9, 0] class = t 551->567 553 dst_host_srv_serror_rate ≤ 0.025 gini = 0.288 samples = 264 value = [0, 218, 0, 46, 0] class = t 552->553 564 dst_host_srv_serror_rate ≤ 0.065 gini = 0.074 samples = 26 value = [0, 25, 1, 0, 0] class = t 552->564 554 srv_serror_rate ≤ 0.07 gini = 0.227 samples = 192 value = [0, 167, 0, 25, 0] class = t 553->554 559 dst_host_srv_serror_rate ≤ 0.035 gini = 0.413 samples = 72 value = [0, 51, 0, 21, 0] class = t 553->559 555 gini = 0.223 samples = 188 value = [0, 164, 0, 24, 0] class = t 554->555 556 srv_serror_rate ≤ 0.235 gini = 0.375 samples = 4 value = [0, 3, 0, 1, 0] class = t 554->556 557 gini = 0.0 samples = 1 value = [0, 0, 0, 1, 0] class = a 556->557 558 gini = 0.0 samples = 3 value = [0, 3, 0, 0, 0] class = t 556->558 560 gini = 0.488 samples = 38 value = [0, 22, 0, 16, 0] class = t 559->560 561 srv_serror_rate ≤ 0.25 gini = 0.251 samples = 34 value = [0, 29, 0, 5, 0] class = t 559->561 562 gini = 0.257 samples = 33 value = [0, 28, 0, 5, 0] class = t 561->562 563 gini = 0.0 samples = 1 value = [0, 1, 0, 0, 0] class = t 561->563 565 gini = 0.0 samples = 8 value = [0, 8, 0, 0, 0] class = t 564->565 566 gini = 0.105 samples = 18 value = [0, 17, 1, 0, 0] class = t 564->566 568 dst_host_srv_serror_rate ≤ 0.025 gini = 0.033 samples = 177 value = [0, 174, 0, 3, 0] class = t 567->568 577 serror_rate ≤ 0.225 gini = 0.24 samples = 222 value = [24, 192, 0, 6, 0] class = t 567->577 569 gini = 0.0 samples = 117 value = [0, 117, 0, 0, 0] class = t 568->569 570 dst_host_srv_serror_rate ≤ 0.045 gini = 0.095 samples = 60 value = [0, 57, 0, 3, 0] class = t 568->570 571 srv_serror_rate ≤ 0.1 gini = 0.153 samples = 36 value = [0, 33, 0, 3, 0] class = t 570->571 576 gini = 0.0 samples = 24 value = [0, 24, 0, 0, 0] class = t 570->576 572 dst_host_srv_serror_rate ≤ 0.035 gini = 0.18 samples = 30 value = [0, 27, 0, 3, 0] class = t 571->572 575 gini = 0.0 samples = 6 value = [0, 6, 0, 0, 0] class = t 571->575 573 gini = 0.133 samples = 14 value = [0, 13, 0, 1, 0] class = t 572->573 574 gini = 0.219 samples = 16 value = [0, 14, 0, 2, 0] class = t 572->574 578 srv_serror_rate ≤ 0.155 gini = 0.292 samples = 176 value = [24, 146, 0, 6, 0] class = t 577->578 603 gini = 0.0 samples = 46 value = [0, 46, 0, 0, 0] class = t 577->603 579 dst_host_srv_serror_rate ≤ 0.035 gini = 0.265 samples = 172 value = [20, 146, 0, 6, 0] class = t 578->579 602 gini = 0.0 samples = 4 value = [4, 0, 0, 0, 0] class = a 578->602 580 srv_serror_rate ≤ 0.135 gini = 0.309 samples = 131 value = [20, 107, 0, 4, 0] class = t 579->580 593 dst_host_srv_serror_rate ≤ 0.055 gini = 0.093 samples = 41 value = [0, 39, 0, 2, 0] class = t 579->593 581 srv_serror_rate ≤ 0.03 gini = 0.302 samples = 129 value = [19, 106, 0, 4, 0] class = t 580->581 590 dst_host_srv_serror_rate ≤ 0.025 gini = 0.5 samples = 2 value = [1, 1, 0, 0, 0] class = a 580->590 582 dst_host_serror_rate ≤ 0.025 gini = 0.318 samples = 121 value = [19, 98, 0, 4, 0] class = t 581->582 589 gini = 0.0 samples = 8 value = [0, 8, 0, 0, 0] class = t 581->589 583 dst_host_srv_serror_rate ≤ 0.025 gini = 0.354 samples = 88 value = [15, 69, 0, 4, 0] class = t 582->583 586 dst_host_srv_serror_rate ≤ 0.025 gini = 0.213 samples = 33 value = [4, 29, 0, 0, 0] class = t 582->586 584 gini = 0.408 samples = 73 value = [15, 54, 0, 4, 0] class = t 583->584 585 gini = 0.0 samples = 15 value = [0, 15, 0, 0, 0] class = t 583->585 587 gini = 0.0 samples = 16 value = [0, 16, 0, 0, 0] class = t 586->587 588 gini = 0.36 samples = 17 value = [4, 13, 0, 0, 0] class = t 586->588 591 gini = 0.0 samples = 1 value = [0, 1, 0, 0, 0] class = t 590->591 592 gini = 0.0 samples = 1 value = [1, 0, 0, 0, 0] class = a 590->592 594 dst_host_srv_serror_rate ≤ 0.045 gini = 0.165 samples = 22 value = [0, 20, 0, 2, 0] class = t 593->594 601 gini = 0.0 samples = 19 value = [0, 19, 0, 0, 0] class = t 593->601 595 gini = 0.0 samples = 10 value = [0, 10, 0, 0, 0] class = t 594->595 596 dst_host_serror_rate ≤ 0.025 gini = 0.278 samples = 12 value = [0, 10, 0, 2, 0] class = t 594->596 597 srv_serror_rate ≤ 0.04 gini = 0.346 samples = 9 value = [0, 7, 0, 2, 0] class = t 596->597 600 gini = 0.0 samples = 3 value = [0, 3, 0, 0, 0] class = t 596->600 598 gini = 0.408 samples = 7 value = [0, 5, 0, 2, 0] class = t 597->598 599 gini = 0.0 samples = 2 value = [0, 2, 0, 0, 0] class = t 597->599 605 dst_host_serror_rate ≤ 0.37 gini = 0.511 samples = 70 value = [0, 32, 1, 37, 0] class = a 604->605 634 dst_host_serror_rate ≤ 0.415 gini = 0.078 samples = 50 value = [1, 48, 0, 1, 0] class = t 604->634 606 dst_host_srv_serror_rate ≤ 0.035 gini = 0.494 samples = 62 value = [0, 24, 1, 37, 0] class = a 605->606 633 gini = 0.0 samples = 8 value = [0, 8, 0, 0, 0] class = t 605->633 607 dst_host_serror_rate ≤ 0.14 gini = 0.515 samples = 20 value = [0, 12, 1, 7, 0] class = t 606->607 618 dst_host_serror_rate ≤ 0.055 gini = 0.408 samples = 42 value = [0, 12, 0, 30, 0] class = a 606->618 608 dst_host_srv_serror_rate ≤ 0.025 gini = 0.165 samples = 11 value = [0, 10, 1, 0, 0] class = t 607->608 613 dst_host_serror_rate ≤ 0.235 gini = 0.346 samples = 9 value = [0, 2, 0, 7, 0] class = a 607->613 609 gini = 0.0 samples = 8 value = [0, 8, 0, 0, 0] class = t 608->609 610 dst_host_serror_rate ≤ 0.105 gini = 0.444 samples = 3 value = [0, 2, 1, 0, 0] class = t 608->610 611 gini = 0.0 samples = 1 value = [0, 0, 1, 0, 0] class = t 610->611 612 gini = 0.0 samples = 2 value = [0, 2, 0, 0, 0] class = t 610->612 614 gini = 0.0 samples = 5 value = [0, 0, 0, 5, 0] class = a 613->614 615 dst_host_serror_rate ≤ 0.29 gini = 0.5 samples = 4 value = [0, 2, 0, 2, 0] class = t 613->615 616 gini = 0.5 samples = 2 value = [0, 1, 0, 1, 0] class = t 615->616 617 gini = 0.5 samples = 2 value = [0, 1, 0, 1, 0] class = t 615->617 619 dst_host_srv_serror_rate ≤ 0.055 gini = 0.444 samples = 27 value = [0, 9, 0, 18, 0] class = a 618->619 626 dst_host_srv_serror_rate ≤ 0.05 gini = 0.32 samples = 15 value = [0, 3, 0, 12, 0] class = a 618->626 620 dst_host_srv_serror_rate ≤ 0.045 gini = 0.34 samples = 23 value = [0, 5, 0, 18, 0] class = a 619->620 625 gini = 0.0 samples = 4 value = [0, 4, 0, 0, 0] class = t 619->625 621 dst_host_serror_rate ≤ 0.045 gini = 0.444 samples = 9 value = [0, 3, 0, 6, 0] class = a 620->621 624 gini = 0.245 samples = 14 value = [0, 2, 0, 12, 0] class = a 620->624 622 gini = 0.375 samples = 8 value = [0, 2, 0, 6, 0] class = a 621->622 623 gini = 0.0 samples = 1 value = [0, 1, 0, 0, 0] class = t 621->623 627 gini = 0.0 samples = 1 value = [0, 1, 0, 0, 0] class = t 626->627 628 dst_host_srv_serror_rate ≤ 0.065 gini = 0.245 samples = 14 value = [0, 2, 0, 12, 0] class = a 626->628 629 gini = 0.0 samples = 7 value = [0, 0, 0, 7, 0] class = a 628->629 630 dst_host_serror_rate ≤ 0.065 gini = 0.408 samples = 7 value = [0, 2, 0, 5, 0] class = a 628->630 631 gini = 0.0 samples = 1 value = [0, 1, 0, 0, 0] class = t 630->631 632 gini = 0.278 samples = 6 value = [0, 1, 0, 5, 0] class = a 630->632 635 serror_rate ≤ 0.185 gini = 0.041 samples = 48 value = [1, 47, 0, 0, 0] class = t 634->635 642 srv_serror_rate ≤ 0.305 gini = 0.5 samples = 2 value = [0, 1, 0, 1, 0] class = t 634->642 636 dst_host_serror_rate ≤ 0.055 gini = 0.245 samples = 7 value = [1, 6, 0, 0, 0] class = t 635->636 641 gini = 0.0 samples = 41 value = [0, 41, 0, 0, 0] class = t 635->641 637 srv_serror_rate ≤ 0.125 gini = 0.444 samples = 3 value = [1, 2, 0, 0, 0] class = t 636->637 640 gini = 0.0 samples = 4 value = [0, 4, 0, 0, 0] class = t 636->640 638 gini = 0.0 samples = 2 value = [0, 2, 0, 0, 0] class = t 637->638 639 gini = 0.0 samples = 1 value = [1, 0, 0, 0, 0] class = a 637->639 643 gini = 0.0 samples = 1 value = [0, 1, 0, 0, 0] class = t 642->643 644 gini = 0.0 samples = 1 value = [0, 0, 0, 1, 0] class = a 642->644 646 dst_host_serror_rate ≤ 0.405 gini = 0.052 samples = 562 value = [0, 547, 1, 13, 1] class = t 645->646 699 dst_host_serror_rate ≤ 0.45 gini = 0.41 samples = 93 value = [17, 69, 0, 7, 0] class = t 645->699 647 dst_host_serror_rate ≤ 0.39 gini = 0.081 samples = 355 value = [0, 340, 1, 13, 1] class = t 646->647 698 gini = 0.0 samples = 207 value = [0, 207, 0, 0, 0] class = t 646->698 648 dst_host_serror_rate ≤ 0.075 gini = 0.076 samples = 354 value = [0, 340, 1, 12, 1] class = t 647->648 697 gini = 0.0 samples = 1 value = [0, 0, 0, 1, 0] class = a 647->697 649 dst_host_serror_rate ≤ 0.045 gini = 0.017 samples = 234 value = [0, 232, 1, 0, 1] class = t 648->649 662 dst_host_srv_serror_rate ≤ 0.335 gini = 0.18 samples = 120 value = [0, 108, 0, 12, 0] class = t 648->662 650 dst_host_srv_serror_rate ≤ 0.245 gini = 0.009 samples = 220 value = [0, 219, 0, 0, 1] class = t 649->650 657 dst_host_srv_serror_rate ≤ 0.315 gini = 0.133 samples = 14 value = [0, 13, 1, 0, 0] class = t 649->657 651 gini = 0.0 samples = 173 value = [0, 173, 0, 0, 0] class = t 650->651 652 dst_host_srv_serror_rate ≤ 0.255 gini = 0.042 samples = 47 value = [0, 46, 0, 0, 1] class = t 650->652 653 dst_host_serror_rate ≤ 0.005 gini = 0.142 samples = 13 value = [0, 12, 0, 0, 1] class = t 652->653 656 gini = 0.0 samples = 34 value = [0, 34, 0, 0, 0] class = t 652->656 654 gini = 0.278 samples = 6 value = [0, 5, 0, 0, 1] class = t 653->654 655 gini = 0.0 samples = 7 value = [0, 7, 0, 0, 0] class = t 653->655 658 gini = 0.0 samples = 12 value = [0, 12, 0, 0, 0] class = t 657->658 659 dst_host_serror_rate ≤ 0.06 gini = 0.5 samples = 2 value = [0, 1, 1, 0, 0] class = t 657->659 660 gini = 0.0 samples = 1 value = [0, 0, 1, 0, 0] class = t 659->660 661 gini = 0.0 samples = 1 value = [0, 1, 0, 0, 0] class = t 659->661 663 serror_rate ≤ 0.125 gini = 0.236 samples = 88 value = [0, 76, 0, 12, 0] class = t 662->663 696 gini = 0.0 samples = 32 value = [0, 32, 0, 0, 0] class = t 662->696 664 dst_host_srv_serror_rate ≤ 0.085 gini = 0.272 samples = 74 value = [0, 62, 0, 12, 0] class = t 663->664 695 gini = 0.0 samples = 14 value = [0, 14, 0, 0, 0] class = t 663->695 665 dst_host_serror_rate ≤ 0.1 gini = 0.469 samples = 8 value = [0, 5, 0, 3, 0] class = t 664->665 668 dst_host_serror_rate ≤ 0.185 gini = 0.236 samples = 66 value = [0, 57, 0, 9, 0] class = t 664->668 666 gini = 0.5 samples = 6 value = [0, 3, 0, 3, 0] class = t 665->666 667 gini = 0.0 samples = 2 value = [0, 2, 0, 0, 0] class = t 665->667 669 dst_host_srv_serror_rate ≤ 0.155 gini = 0.198 samples = 45 value = [0, 40, 0, 5, 0] class = t 668->669 686 dst_host_serror_rate ≤ 0.225 gini = 0.308 samples = 21 value = [0, 17, 0, 4, 0] class = t 668->686 670 dst_host_serror_rate ≤ 0.085 gini = 0.302 samples = 27 value = [0, 22, 0, 5, 0] class = t 669->670 685 gini = 0.0 samples = 18 value = [0, 18, 0, 0, 0] class = t 669->685 671 gini = 0.0 samples = 2 value = [0, 2, 0, 0, 0] class = t 670->671 672 dst_host_srv_serror_rate ≤ 0.105 gini = 0.32 samples = 25 value = [0, 20, 0, 5, 0] class = t 670->672 673 dst_host_serror_rate ≤ 0.095 gini = 0.375 samples = 8 value = [0, 6, 0, 2, 0] class = t 672->673 676 dst_host_serror_rate ≤ 0.105 gini = 0.291 samples = 17 value = [0, 14, 0, 3, 0] class = t 672->676 674 gini = 0.375 samples = 4 value = [0, 3, 0, 1, 0] class = t 673->674 675 gini = 0.375 samples = 4 value = [0, 3, 0, 1, 0] class = t 673->675 677 gini = 0.0 samples = 1 value = [0, 1, 0, 0, 0] class = t 676->677 678 dst_host_srv_serror_rate ≤ 0.115 gini = 0.305 samples = 16 value = [0, 13, 0, 3, 0] class = t 676->678 679 gini = 0.375 samples = 4 value = [0, 3, 0, 1, 0] class = t 678->679 680 dst_host_srv_serror_rate ≤ 0.135 gini = 0.278 samples = 12 value = [0, 10, 0, 2, 0] class = t 678->680 681 dst_host_srv_serror_rate ≤ 0.125 gini = 0.219 samples = 8 value = [0, 7, 0, 1, 0] class = t 680->681 684 gini = 0.375 samples = 4 value = [0, 3, 0, 1, 0] class = t 680->684 682 gini = 0.245 samples = 7 value = [0, 6, 0, 1, 0] class = t 681->682 683 gini = 0.0 samples = 1 value = [0, 1, 0, 0, 0] class = t 681->683 687 gini = 0.0 samples = 2 value = [0, 0, 0, 2, 0] class = a 686->687 688 dst_host_srv_serror_rate ≤ 0.225 gini = 0.188 samples = 19 value = [0, 17, 0, 2, 0] class = t 686->688 689 gini = 0.0 samples = 8 value = [0, 8, 0, 0, 0] class = t 688->689 690 dst_host_serror_rate ≤ 0.31 gini = 0.298 samples = 11 value = [0, 9, 0, 2, 0] class = t 688->690 691 dst_host_srv_serror_rate ≤ 0.28 gini = 0.18 samples = 10 value = [0, 9, 0, 1, 0] class = t 690->691 694 gini = 0.0 samples = 1 value = [0, 0, 0, 1, 0] class = a 690->694 692 gini = 0.5 samples = 2 value = [0, 1, 0, 1, 0] class = t 691->692 693 gini = 0.0 samples = 8 value = [0, 8, 0, 0, 0] class = t 691->693 700 gini = 0.0 samples = 64 value = [0, 64, 0, 0, 0] class = t 699->700 701 srv_serror_rate ≤ 0.88 gini = 0.568 samples = 29 value = [17, 5, 0, 7, 0] class = a 699->701 702 gini = 0.0 samples = 6 value = [0, 0, 0, 6, 0] class = a 701->702 703 dst_host_srv_serror_rate ≤ 0.575 gini = 0.405 samples = 23 value = [17, 5, 0, 1, 0] class = a 701->703 704 dst_host_serror_rate ≤ 0.585 gini = 0.531 samples = 8 value = [2, 5, 0, 1, 0] class = t 703->704 711 gini = 0.0 samples = 15 value = [15, 0, 0, 0, 0] class = a 703->711 705 dst_host_srv_serror_rate ≤ 0.1 gini = 0.625 samples = 4 value = [2, 1, 0, 1, 0] class = a 704->705 710 gini = 0.0 samples = 4 value = [0, 4, 0, 0, 0] class = t 704->710 706 gini = 0.0 samples = 1 value = [0, 1, 0, 0, 0] class = t 705->706 707 dst_host_srv_serror_rate ≤ 0.525 gini = 0.444 samples = 3 value = [2, 0, 0, 1, 0] class = a 705->707 708 gini = 0.0 samples = 2 value = [2, 0, 0, 0, 0] class = a 707->708 709 gini = 0.0 samples = 1 value = [0, 0, 0, 1, 0] class = a 707->709 713 gini = 0.0 samples = 16 value = [0, 16, 0, 0, 0] class = t 712->713 714 dst_host_srv_serror_rate ≤ 0.035 gini = 0.131 samples = 29 value = [27, 1, 1, 0, 0] class = a 712->714 715 dst_host_serror_rate ≤ 0.94 gini = 0.444 samples = 3 value = [2, 0, 1, 0, 0] class = a 714->715 718 dst_host_serror_rate ≤ 0.935 gini = 0.074 samples = 26 value = [25, 1, 0, 0, 0] class = a 714->718 716 gini = 0.0 samples = 2 value = [2, 0, 0, 0, 0] class = a 715->716 717 gini = 0.0 samples = 1 value = [0, 0, 1, 0, 0] class = t 715->717 719 dst_host_srv_serror_rate ≤ 0.23 gini = 0.375 samples = 4 value = [3, 1, 0, 0, 0] class = a 718->719 722 gini = 0.0 samples = 22 value = [22, 0, 0, 0, 0] class = a 718->722 720 gini = 0.0 samples = 3 value = [3, 0, 0, 0, 0] class = a 719->720 721 gini = 0.0 samples = 1 value = [0, 1, 0, 0, 0] class = t 719->721 724 dst_host_serror_rate ≤ 0.015 gini = 0.291 samples = 17 value = [0, 14, 3, 0, 0] class = t 723->724 731 dst_host_serror_rate ≤ 0.905 gini = 0.154 samples = 166 value = [14, 0, 152, 0, 0] class = t 723->731 725 dst_host_serror_rate ≤ 0.005 gini = 0.142 samples = 13 value = [0, 12, 1, 0, 0] class = t 724->725 728 same_srv_rate ≤ 0.75 gini = 0.5 samples = 4 value = [0, 2, 2, 0, 0] class = t 724->728 726 gini = 0.0 samples = 3 value = [0, 3, 0, 0, 0] class = t 725->726 727 gini = 0.18 samples = 10 value = [0, 9, 1, 0, 0] class = t 725->727 729 gini = 0.0 samples = 1 value = [0, 0, 1, 0, 0] class = t 728->729 730 gini = 0.444 samples = 3 value = [0, 2, 1, 0, 0] class = t 728->730 732 same_srv_rate ≤ 0.75 gini = 0.307 samples = 74 value = [14, 0, 60, 0, 0] class = t 731->732 769 gini = 0.0 samples = 92 value = [0, 0, 92, 0, 0] class = t 731->769 733 gini = 0.0 samples = 11 value = [0, 0, 11, 0, 0] class = t 732->733 734 dst_host_serror_rate ≤ 0.815 gini = 0.346 samples = 63 value = [14, 0, 49, 0, 0] class = t 732->734 735 dst_host_serror_rate ≤ 0.715 gini = 0.269 samples = 25 value = [4, 0, 21, 0, 0] class = t 734->735 752 dst_host_serror_rate ≤ 0.885 gini = 0.388 samples = 38 value = [10, 0, 28, 0, 0] class = t 734->752 736 dst_host_serror_rate ≤ 0.7 gini = 0.375 samples = 12 value = [3, 0, 9, 0, 0] class = t 735->736 747 dst_host_serror_rate ≤ 0.77 gini = 0.142 samples = 13 value = [1, 0, 12, 0, 0] class = t 735->747 737 dst_host_serror_rate ≤ 0.61 gini = 0.32 samples = 10 value = [2, 0, 8, 0, 0] class = t 736->737 746 gini = 0.5 samples = 2 value = [1, 0, 1, 0, 0] class = a 736->746 738 dst_host_serror_rate ≤ 0.29 gini = 0.408 samples = 7 value = [2, 0, 5, 0, 0] class = t 737->738 745 gini = 0.0 samples = 3 value = [0, 0, 3, 0, 0] class = t 737->745 739 gini = 0.0 samples = 2 value = [0, 0, 2, 0, 0] class = t 738->739 740 dst_host_serror_rate ≤ 0.53 gini = 0.48 samples = 5 value = [2, 0, 3, 0, 0] class = t 738->740 741 gini = 0.0 samples = 1 value = [1, 0, 0, 0, 0] class = a 740->741 742 dst_host_serror_rate ≤ 0.59 gini = 0.375 samples = 4 value = [1, 0, 3, 0, 0] class = t 740->742 743 gini = 0.0 samples = 2 value = [0, 0, 2, 0, 0] class = t 742->743 744 gini = 0.5 samples = 2 value = [1, 0, 1, 0, 0] class = a 742->744 748 gini = 0.0 samples = 5 value = [0, 0, 5, 0, 0] class = t 747->748 749 dst_host_serror_rate ≤ 0.785 gini = 0.219 samples = 8 value = [1, 0, 7, 0, 0] class = t 747->749 750 gini = 0.444 samples = 3 value = [1, 0, 2, 0, 0] class = t 749->750 751 gini = 0.0 samples = 5 value = [0, 0, 5, 0, 0] class = t 749->751 753 dst_host_serror_rate ≤ 0.865 gini = 0.434 samples = 22 value = [7, 0, 15, 0, 0] class = t 752->753 766 dst_host_serror_rate ≤ 0.895 gini = 0.305 samples = 16 value = [3, 0, 13, 0, 0] class = t 752->766 754 dst_host_serror_rate ≤ 0.825 gini = 0.391 samples = 15 value = [4, 0, 11, 0, 0] class = t 753->754 763 dst_host_serror_rate ≤ 0.875 gini = 0.49 samples = 7 value = [3, 0, 4, 0, 0] class = t 753->763 755 gini = 0.5 samples = 2 value = [1, 0, 1, 0, 0] class = a 754->755 756 dst_host_serror_rate ≤ 0.855 gini = 0.355 samples = 13 value = [3, 0, 10, 0, 0] class = t 754->756 757 dst_host_serror_rate ≤ 0.835 gini = 0.32 samples = 10 value = [2, 0, 8, 0, 0] class = t 756->757 762 gini = 0.444 samples = 3 value = [1, 0, 2, 0, 0] class = t 756->762 758 gini = 0.375 samples = 4 value = [1, 0, 3, 0, 0] class = t 757->758 759 dst_host_serror_rate ≤ 0.845 gini = 0.278 samples = 6 value = [1, 0, 5, 0, 0] class = t 757->759 760 gini = 0.0 samples = 1 value = [0, 0, 1, 0, 0] class = t 759->760 761 gini = 0.32 samples = 5 value = [1, 0, 4, 0, 0] class = t 759->761 764 gini = 0.5 samples = 2 value = [1, 0, 1, 0, 0] class = a 763->764 765 gini = 0.48 samples = 5 value = [2, 0, 3, 0, 0] class = t 763->765 767 gini = 0.346 samples = 9 value = [2, 0, 7, 0, 0] class = t 766->767 768 gini = 0.245 samples = 7 value = [1, 0, 6, 0, 0] class = t 766->768 771 dst_host_srv_serror_rate ≤ 0.015 gini = 0.034 samples = 58 value = [0, 57, 0, 1, 0] class = t 770->771 778 dst_host_serror_rate ≤ 0.975 gini = 0.152 samples = 812 value = [746, 17, 47, 2, 0] class = a 770->778 772 gini = 0.0 samples = 45 value = [0, 45, 0, 0, 0] class = t 771->772 773 dst_host_srv_serror_rate ≤ 0.025 gini = 0.142 samples = 13 value = [0, 12, 0, 1, 0] class = t 771->773 774 srv_serror_rate ≤ 0.65 gini = 0.278 samples = 6 value = [0, 5, 0, 1, 0] class = t 773->774 777 gini = 0.0 samples = 7 value = [0, 7, 0, 0, 0] class = t 773->777 775 gini = 0.0 samples = 3 value = [0, 3, 0, 0, 0] class = t 774->775 776 gini = 0.444 samples = 3 value = [0, 2, 0, 1, 0] class = t 774->776 779 dst_host_srv_serror_rate ≤ 0.975 gini = 0.545 samples = 41 value = [20, 2, 19, 0, 0] class = a 778->779 788 serror_rate ≤ 0.25 gini = 0.112 samples = 771 value = [726, 15, 28, 2, 0] class = a 778->788 780 serror_rate ≤ 0.5 gini = 0.234 samples = 23 value = [20, 2, 1, 0, 0] class = a 779->780 787 gini = 0.0 samples = 18 value = [0, 0, 18, 0, 0] class = t 779->787 781 gini = 0.0 samples = 2 value = [0, 2, 0, 0, 0] class = t 780->781 782 dst_host_srv_serror_rate ≤ 0.38 gini = 0.091 samples = 21 value = [20, 0, 1, 0, 0] class = a 780->782 783 gini = 0.0 samples = 13 value = [13, 0, 0, 0, 0] class = a 782->783 784 dst_host_srv_serror_rate ≤ 0.66 gini = 0.219 samples = 8 value = [7, 0, 1, 0, 0] class = a 782->784 785 gini = 0.0 samples = 1 value = [0, 0, 1, 0, 0] class = t 784->785 786 gini = 0.0 samples = 7 value = [7, 0, 0, 0, 0] class = a 784->786 789 gini = 0.0 samples = 6 value = [0, 6, 0, 0, 0] class = t 788->789 790 same_srv_rate ≤ 0.975 gini = 0.098 samples = 765 value = [726, 9, 28, 2, 0] class = a 788->790 791 gini = 0.0 samples = 443 value = [443, 0, 0, 0, 0] class = a 790->791 792 dst_host_srv_serror_rate ≤ 0.99 gini = 0.219 samples = 322 value = [283, 9, 28, 2, 0] class = a 790->792 793 dst_host_srv_serror_rate ≤ 0.335 gini = 0.043 samples = 136 value = [133, 3, 0, 0, 0] class = a 792->793 804 srv_serror_rate ≤ 0.745 gini = 0.326 samples = 186 value = [150, 6, 28, 2, 0] class = a 792->804 794 dst_host_srv_serror_rate ≤ 0.145 gini = 0.375 samples = 12 value = [9, 3, 0, 0, 0] class = a 793->794 803 gini = 0.0 samples = 124 value = [124, 0, 0, 0, 0] class = a 793->803 795 gini = 0.0 samples = 3 value = [3, 0, 0, 0, 0] class = a 794->795 796 dst_host_serror_rate ≤ 0.99 gini = 0.444 samples = 9 value = [6, 3, 0, 0, 0] class = a 794->796 797 gini = 0.0 samples = 2 value = [2, 0, 0, 0, 0] class = a 796->797 798 dst_host_srv_serror_rate ≤ 0.315 gini = 0.49 samples = 7 value = [4, 3, 0, 0, 0] class = a 796->798 799 dst_host_srv_serror_rate ≤ 0.195 gini = 0.444 samples = 6 value = [4, 2, 0, 0, 0] class = a 798->799 802 gini = 0.0 samples = 1 value = [0, 1, 0, 0, 0] class = t 798->802 800 gini = 0.5 samples = 4 value = [2, 2, 0, 0, 0] class = a 799->800 801 gini = 0.0 samples = 2 value = [2, 0, 0, 0, 0] class = a 799->801 805 srv_serror_rate ≤ 0.54 gini = 0.5 samples = 2 value = [1, 0, 0, 1, 0] class = a 804->805 808 srv_serror_rate ≤ 0.975 gini = 0.32 samples = 184 value = [149, 6, 28, 1, 0] class = a 804->808 806 gini = 0.0 samples = 1 value = [1, 0, 0, 0, 0] class = a 805->806 807 gini = 0.0 samples = 1 value = [0, 0, 0, 1, 0] class = a 805->807 809 gini = 0.0 samples = 10 value = [10, 0, 0, 0, 0] class = a 808->809 810 dst_host_serror_rate ≤ 0.995 gini = 0.335 samples = 174 value = [139, 6, 28, 1, 0] class = a 808->810 811 gini = 0.0 samples = 2 value = [2, 0, 0, 0, 0] class = a 810->811 812 gini = 0.338 samples = 172 value = [137, 6, 28, 1, 0] class = a 810->812

Features Selection Using Information Gain

In [56]:
# extract the features and target variable
X = dataset.drop('attack_type', axis=1)
y = dataset['attack_type']

# calculate the information gain of each feature
info_gain = mutual_info_classif(X, y)

# create a dataframe to store the information gain of each feature
ig_df = pd.DataFrame({'feature': X.columns, 'info_gain': info_gain})

# sort the dataframe by information gain in descending order
ig_df = ig_df.sort_values(by='info_gain', ascending=False)

# select the top five features based on information gain
top_5_cols_using_ig = list(ig_df['feature'][:5])
print("Top 5 features based on Information Gain:", top_5_cols_using_ig)
Top 5 features based on Information Gain: ['attack_category', 'src_bytes', 'service', 'diff_srv_rate', 'flag']
In [57]:
best_features_using_ig = dataset[top_5_cols_using_ig]
In [58]:
best_features_using_ig.head()
Out[58]:
attack_category src_bytes service diff_srv_rate flag
0 11 491 20 0.00 9
1 11 146 44 0.15 9
2 9 0 49 0.07 5
3 11 232 24 0.00 9
4 11 199 24 0.00 9
In [59]:
best_features_using_ig.tail()
Out[59]:
attack_category src_bytes service diff_srv_rate flag
125968 9 0 49 0.06 5
125969 11 105 49 0.00 9
125970 11 2231 54 0.00 9
125971 9 0 30 0.05 5
125972 11 151 20 0.00 9
In [60]:
best_features_using_ig.describe()
Out[60]:
attack_category src_bytes service diff_srv_rate flag
count 125973.000000 1.259730e+05 125973.000000 125973.000000 125973.000000
mean 10.625483 4.556674e+04 31.226469 0.063053 6.979996
std 2.636084 5.870331e+06 16.346470 0.180314 2.689365
min 0.000000 0.000000e+00 0.000000 0.000000 0.000000
25% 9.000000 0.000000e+00 20.000000 0.000000 5.000000
50% 11.000000 4.400000e+01 24.000000 0.000000 9.000000
75% 11.000000 2.760000e+02 49.000000 0.060000 9.000000
max 22.000000 1.379964e+09 69.000000 1.000000 10.000000
In [61]:
best_features_using_ig.info()
<class 'pandas.core.frame.DataFrame'>
RangeIndex: 125973 entries, 0 to 125972
Data columns (total 5 columns):
 #   Column           Non-Null Count   Dtype  
---  ------           --------------   -----  
 0   attack_category  125973 non-null  int64  
 1   src_bytes        125973 non-null  int64  
 2   service          125973 non-null  int64  
 3   diff_srv_rate    125973 non-null  float64
 4   flag             125973 non-null  int64  
dtypes: float64(1), int64(4)
memory usage: 4.8 MB
In [62]:
best_features_using_ig.shape
Out[62]:
(125973, 5)

Applying Decision Tree Model Entropy Criteria

In [63]:
X = best_features_using_ig
y = dataset['attack_type']

X_train, X_test, y_train, y_test = train_test_split(X, y, test_size=0.2, random_state=42)
In [64]:
X_train.shape
Out[64]:
(100778, 5)
In [65]:
X_test.shape
Out[65]:
(25195, 5)
In [66]:
y_train.shape
Out[66]:
(100778,)
In [67]:
y_test.shape
Out[67]:
(25195,)
In [68]:
X_train.head()
Out[68]:
attack_category src_bytes service diff_srv_rate flag
95141 11 214 24 0.00 9
37486 9 0 49 0.06 5
34926 9 0 24 0.06 1
34589 11 257 24 0.00 9
11420 11 516 44 0.00 9
In [69]:
X_test.head()
Out[69]:
attack_category src_bytes service diff_srv_rate flag
378 11 36 12 0.00 9
32038 9 0 24 0.10 5
86399 9 0 47 0.06 5
74412 9 0 49 0.06 1
52951 15 0 49 0.00 4

Decision Tree Entropy Criteria

In [70]:
clf_using_ig_entropy = DecisionTreeClassifier(criterion='entropy', random_state=42)
clf_using_ig_entropy.fit(X_train, y_train)
Out[70]:
DecisionTreeClassifier(criterion='entropy', random_state=42)

Confusion Matrix

In [71]:
y_pred = clf_using_ig_entropy.predict(X_test)
In [72]:
# calculate F1 score
cm = confusion_matrix(y_test, y_pred)
f1 = f1_score(y_test, y_pred, average='weighted')
print("F1 Score:", f1)

# calculate accuracy
accuracy = accuracy_score(y_test, y_pred)
print("Accuracy:", accuracy)

# calculate error rate
error_rate = 1 - accuracy
print("Error Rate:", error_rate)

# plot confusion matrix
sns.heatmap(cm, annot=True, cmap="Blues")
plt.title("Confusion Matrix")
plt.xlabel("Predicted Labels")
plt.ylabel("True Labels")
plt.savefig("cm_dt_ig_entropy.png")
plt.show()
F1 Score: 0.9998534368369423
Accuracy: 0.9998412383409406
Error Rate: 0.0001587616590593699

Inference:

  1. The Confusion matrix shows that there are only 4 values that are predicted wrong.
  2. Third row 5th column has a value 1 that shows that True value is 2 but the model predicted it as 4.
  3. Frist row 5th column has a value 3 that shows that True value is 3 but the model predicted it as 4.
In [73]:
# Visualize the decision tree
dot_data = export_graphviz(clf_using_ig_entropy, out_file=None, 
                           feature_names=top_5_cols_using_ig,  
                           class_names='attack_type',  
                           filled=True, rounded=True,  
                           special_characters=True)  
# graph = graphviz.Source(dot_data)  
# graph.render("iris_decision_tree")
graph = graphviz.Source(dot_data)
display(SVG(graph.pipe(format='svg')))
Tree 0 attack_category ≤ 10.5 entropy = 1.389 samples = 100778 value = [36746, 53921, 9299, 771, 41] class = t 1 diff_srv_rate ≤ 0.02 entropy = 0.518 samples = 37915 value = [33772, 0, 4046, 67, 30] class = a 0->1 True 42 attack_category ≤ 11.5 entropy = 0.772 samples = 62863 value = [2974, 53921, 5253, 704, 11] class = t 0->42 False 2 attack_category ≤ 4.5 entropy = 0.887 samples = 5247 value = [1132, 0, 4024, 67, 24] class = t 1->2 29 flag ≤ 7.0 entropy = 0.011 samples = 32668 value = [32640, 0, 22, 0, 6] class = a 1->29 3 attack_category ≤ 0.5 entropy = 0.517 samples = 842 value = [764, 0, 0, 60, 18] class = a 2->3 8 flag ≤ 7.0 entropy = 0.446 samples = 4405 value = [368, 0, 4024, 7, 6] class = t 2->8 4 entropy = 0.0 samples = 764 value = [764, 0, 0, 0, 0] class = a 3->4 5 attack_category ≤ 1.5 entropy = 0.779 samples = 78 value = [0, 0, 0, 60, 18] class = a 3->5 6 entropy = 0.0 samples = 18 value = [0, 0, 0, 0, 18] class = c 5->6 7 entropy = 0.0 samples = 60 value = [0, 0, 0, 60, 0] class = a 5->7 9 attack_category ≤ 5.5 entropy = 1.0 samples = 719 value = [368, 0, 351, 0, 0] class = a 8->9 12 src_bytes ≤ 222.5 entropy = 0.037 samples = 3686 value = [0, 0, 3673, 7, 6] class = t 8->12 10 entropy = 0.0 samples = 351 value = [0, 0, 351, 0, 0] class = t 9->10 11 entropy = 0.0 samples = 368 value = [368, 0, 0, 0, 0] class = a 9->11 13 service ≤ 18.5 entropy = 0.019 samples = 3678 value = [0, 0, 3672, 4, 2] class = t 12->13 24 src_bytes ≤ 432.0 entropy = 1.406 samples = 8 value = [0, 0, 1, 3, 4] class = c 12->24 14 entropy = 0.0 samples = 3266 value = [0, 0, 3266, 0, 0] class = t 13->14 15 service ≤ 20.5 entropy = 0.123 samples = 412 value = [0, 0, 406, 4, 2] class = t 13->15 16 attack_category ≤ 9.0 entropy = 0.722 samples = 5 value = [0, 0, 1, 4, 0] class = a 15->16 19 service ≤ 58.0 entropy = 0.045 samples = 407 value = [0, 0, 405, 0, 2] class = t 15->19 17 entropy = 0.0 samples = 4 value = [0, 0, 0, 4, 0] class = a 16->17 18 entropy = 0.0 samples = 1 value = [0, 0, 1, 0, 0] class = t 16->18 20 entropy = 0.0 samples = 387 value = [0, 0, 387, 0, 0] class = t 19->20 21 src_bytes ≤ 67.5 entropy = 0.469 samples = 20 value = [0, 0, 18, 0, 2] class = t 19->21 22 entropy = 0.0 samples = 18 value = [0, 0, 18, 0, 0] class = t 21->22 23 entropy = 0.0 samples = 2 value = [0, 0, 0, 0, 2] class = c 21->23 25 entropy = 0.0 samples = 4 value = [0, 0, 0, 0, 4] class = c 24->25 26 src_bytes ≤ 2762.5 entropy = 0.811 samples = 4 value = [0, 0, 1, 3, 0] class = a 24->26 27 entropy = 0.0 samples = 3 value = [0, 0, 0, 3, 0] class = a 26->27 28 entropy = 0.0 samples = 1 value = [0, 0, 1, 0, 0] class = t 26->28 30 attack_category ≤ 3.5 entropy = 0.001 samples = 32634 value = [32633, 0, 0, 0, 1] class = a 29->30 35 src_bytes ≤ 6525.0 entropy = 1.283 samples = 34 value = [7, 0, 22, 0, 5] class = t 29->35 31 attack_category ≤ 0.5 entropy = 1.0 samples = 2 value = [1, 0, 0, 0, 1] class = a 30->31 34 entropy = 0.0 samples = 32632 value = [32632, 0, 0, 0, 0] class = a 30->34 32 entropy = 0.0 samples = 1 value = [1, 0, 0, 0, 0] class = a 31->32 33 entropy = 0.0 samples = 1 value = [0, 0, 0, 0, 1] class = c 31->33 36 attack_category ≤ 8.5 entropy = 0.691 samples = 27 value = [0, 0, 22, 0, 5] class = t 35->36 41 entropy = 0.0 samples = 7 value = [7, 0, 0, 0, 0] class = a 35->41 37 service ≤ 17.0 entropy = 0.961 samples = 13 value = [0, 0, 8, 0, 5] class = t 36->37 40 entropy = 0.0 samples = 14 value = [0, 0, 14, 0, 0] class = t 36->40 38 entropy = 0.0 samples = 8 value = [0, 0, 8, 0, 0] class = t 37->38 39 entropy = 0.0 samples = 5 value = [0, 0, 0, 0, 5] class = c 37->39 43 entropy = 0.0 samples = 53921 value = [0, 53921, 0, 0, 0] class = t 42->43 44 src_bytes ≤ 24.0 entropy = 1.28 samples = 8942 value = [2974, 0, 5253, 704, 11] class = t 42->44 45 attack_category ≤ 19.5 entropy = 0.027 samples = 5237 value = [0, 0, 5224, 10, 3] class = t 44->45 58 attack_category ≤ 20.5 entropy = 0.781 samples = 3705 value = [2974, 0, 29, 694, 8] class = a 44->58 46 src_bytes ≤ 2.5 entropy = 0.007 samples = 5227 value = [0, 0, 5224, 0, 3] class = t 45->46 57 entropy = 0.0 samples = 10 value = [0, 0, 0, 10, 0] class = a 45->57 47 service ≤ 20.5 entropy = 0.003 samples = 5115 value = [0, 0, 5114, 0, 1] class = t 46->47 54 src_bytes ≤ 4.5 entropy = 0.129 samples = 112 value = [0, 0, 110, 0, 2] class = t 46->54 48 flag ≤ 7.0 entropy = 0.052 samples = 169 value = [0, 0, 168, 0, 1] class = t 47->48 53 entropy = 0.0 samples = 4946 value = [0, 0, 4946, 0, 0] class = t 47->53 49 entropy = 0.0 samples = 163 value = [0, 0, 163, 0, 0] class = t 48->49 50 attack_category ≤ 16.5 entropy = 0.65 samples = 6 value = [0, 0, 5, 0, 1] class = t 48->50 51 entropy = 0.0 samples = 1 value = [0, 0, 0, 0, 1] class = c 50->51 52 entropy = 0.0 samples = 5 value = [0, 0, 5, 0, 0] class = t 50->52 55 entropy = 0.0 samples = 2 value = [0, 0, 0, 0, 2] class = c 54->55 56 entropy = 0.0 samples = 110 value = [0, 0, 110, 0, 0] class = t 54->56 59 service ≤ 51.5 entropy = 0.119 samples = 3015 value = [2974, 0, 29, 4, 8] class = a 58->59 80 entropy = 0.0 samples = 690 value = [0, 0, 0, 690, 0] class = a 58->80 60 diff_srv_rate ≤ 0.24 entropy = 0.051 samples = 2989 value = [2974, 0, 11, 3, 1] class = a 59->60 71 attack_category ≤ 16.5 entropy = 1.058 samples = 26 value = [0, 0, 18, 1, 7] class = t 59->71 61 flag ≤ 6.5 entropy = 0.027 samples = 2981 value = [2974, 0, 3, 3, 1] class = a 60->61 70 entropy = 0.0 samples = 8 value = [0, 0, 8, 0, 0] class = t 60->70 62 entropy = 0.0 samples = 3 value = [0, 0, 3, 0, 0] class = t 61->62 63 attack_category ≤ 13.5 entropy = 0.016 samples = 2978 value = [2974, 0, 0, 3, 1] class = a 61->63 64 entropy = 0.0 samples = 3 value = [0, 0, 0, 3, 0] class = a 63->64 65 attack_category ≤ 17.0 entropy = 0.004 samples = 2975 value = [2974, 0, 0, 0, 1] class = a 63->65 66 service ≤ 17.0 entropy = 0.055 samples = 159 value = [158, 0, 0, 0, 1] class = a 65->66 69 entropy = 0.0 samples = 2816 value = [2816, 0, 0, 0, 0] class = a 65->69 67 entropy = 0.0 samples = 158 value = [158, 0, 0, 0, 0] class = a 66->67 68 entropy = 0.0 samples = 1 value = [0, 0, 0, 0, 1] class = c 66->68 72 src_bytes ≤ 947.0 entropy = 0.881 samples = 10 value = [0, 0, 3, 0, 7] class = c 71->72 77 attack_category ≤ 18.0 entropy = 0.337 samples = 16 value = [0, 0, 15, 1, 0] class = t 71->77 73 entropy = 0.0 samples = 6 value = [0, 0, 0, 0, 6] class = c 72->73 74 attack_category ≤ 15.5 entropy = 0.811 samples = 4 value = [0, 0, 3, 0, 1] class = t 72->74 75 entropy = 0.0 samples = 3 value = [0, 0, 3, 0, 0] class = t 74->75 76 entropy = 0.0 samples = 1 value = [0, 0, 0, 0, 1] class = c 74->76 78 entropy = 0.0 samples = 15 value = [0, 0, 15, 0, 0] class = t 77->78 79 entropy = 0.0 samples = 1 value = [0, 0, 0, 1, 0] class = a 77->79

Decision Tree Using Gini Criteria

In [74]:
X = best_features_using_ig
y = dataset['attack_type']

X_train, X_test, y_train, y_test = train_test_split(X, y, test_size=0.2, random_state=42)
In [75]:
clf_using_ig_gini = DecisionTreeClassifier(criterion='gini', random_state=42)
clf_using_ig_gini.fit(X_train, y_train)
Out[75]:
DecisionTreeClassifier(random_state=42)

Confusion Matrix

In [76]:
y_pred = clf_using_ig_gini.predict(X_test)
In [77]:
# calculate F1 score
cm = confusion_matrix(y_test, y_pred)
f1 = f1_score(y_test, y_pred, average='weighted')
print("F1 Score:", f1)

# calculate accuracy
accuracy = accuracy_score(y_test, y_pred)
print("Accuracy:", accuracy)

# calculate error rate
error_rate = 1 - accuracy
print("Error Rate:", error_rate)

# plot confusion matrix
sns.heatmap(cm, annot=True, cmap="Blues")
plt.title("Confusion Matrix")
plt.xlabel("Predicted Labels")
plt.ylabel("True Labels")
plt.savefig("cm_dt_ig_gini.png")
plt.show()
F1 Score: 0.9998534368369423
Accuracy: 0.9998412383409406
Error Rate: 0.0001587616590593699
In [78]:
# Visualize the decision tree
dot_data = export_graphviz(clf_using_ig_gini, out_file=None, 
                           feature_names=top_5_cols_using_ig,  
                           class_names='attack_type',  
                           filled=True, rounded=True,  
                           special_characters=True)  
# graph = graphviz.Source(dot_data)  
# graph.render("iris_decision_tree")
graph = graphviz.Source(dot_data)
display(SVG(graph.pipe(format='svg')))
Tree 0 attack_category ≤ 9.5 gini = 0.572 samples = 100778 value = [36746, 53921, 9299, 771, 41] class = t 1 attack_category ≤ 5.5 gini = 0.149 samples = 36735 value = [33772, 0, 2866, 67, 30] class = a 0->1 True 16 attack_category ≤ 11.5 gini = 0.279 samples = 64043 value = [2974, 53921, 6433, 704, 11] class = t 0->16 False 2 attack_category ≤ 4.5 gini = 0.363 samples = 3718 value = [771, 0, 2866, 60, 21] class = t 1->2 9 flag ≤ 7.0 gini = 0.001 samples = 33017 value = [33001, 0, 0, 7, 9] class = a 1->9 3 src_bytes ≤ 9707.0 gini = 0.176 samples = 852 value = [771, 0, 0, 60, 21] class = a 2->3 8 gini = 0.0 samples = 2866 value = [0, 0, 2866, 0, 0] class = t 2->8 4 attack_category ≤ 1.5 gini = 0.384 samples = 81 value = [0, 0, 0, 60, 21] class = a 3->4 7 gini = 0.0 samples = 771 value = [771, 0, 0, 0, 0] class = a 3->7 5 gini = 0.0 samples = 21 value = [0, 0, 0, 0, 21] class = c 4->5 6 gini = 0.0 samples = 60 value = [0, 0, 0, 60, 0] class = a 4->6 10 gini = 0.0 samples = 33000 value = [33000, 0, 0, 0, 0] class = a 9->10 11 attack_category ≤ 7.5 gini = 0.547 samples = 17 value = [1, 0, 0, 7, 9] class = c 9->11 12 gini = 0.0 samples = 9 value = [0, 0, 0, 0, 9] class = c 11->12 13 src_bytes ≤ 6063.0 gini = 0.219 samples = 8 value = [1, 0, 0, 7, 0] class = a 11->13 14 gini = 0.0 samples = 7 value = [0, 0, 0, 7, 0] class = a 13->14 15 gini = 0.0 samples = 1 value = [1, 0, 0, 0, 0] class = a 13->15 17 attack_category ≤ 10.5 gini = 0.042 samples = 55101 value = [0, 53921, 1180, 0, 0] class = t 16->17 20 src_bytes ≤ 24.0 gini = 0.538 samples = 8942 value = [2974, 0, 5253, 704, 11] class = t 16->20 18 gini = 0.0 samples = 1180 value = [0, 0, 1180, 0, 0] class = t 17->18 19 gini = 0.0 samples = 53921 value = [0, 53921, 0, 0, 0] class = t 17->19 21 attack_category ≤ 19.5 gini = 0.005 samples = 5237 value = [0, 0, 5224, 10, 3] class = t 20->21 34 attack_category ≤ 20.5 gini = 0.321 samples = 3705 value = [2974, 0, 29, 694, 8] class = a 20->34 22 src_bytes ≤ 2.5 gini = 0.001 samples = 5227 value = [0, 0, 5224, 0, 3] class = t 21->22 33 gini = 0.0 samples = 10 value = [0, 0, 0, 10, 0] class = a 21->33 23 service ≤ 20.5 gini = 0.0 samples = 5115 value = [0, 0, 5114, 0, 1] class = t 22->23 30 src_bytes ≤ 4.5 gini = 0.035 samples = 112 value = [0, 0, 110, 0, 2] class = t 22->30 24 flag ≤ 7.0 gini = 0.012 samples = 169 value = [0, 0, 168, 0, 1] class = t 23->24 29 gini = 0.0 samples = 4946 value = [0, 0, 4946, 0, 0] class = t 23->29 25 gini = 0.0 samples = 163 value = [0, 0, 163, 0, 0] class = t 24->25 26 service ≤ 16.0 gini = 0.278 samples = 6 value = [0, 0, 5, 0, 1] class = t 24->26 27 gini = 0.0 samples = 5 value = [0, 0, 5, 0, 0] class = t 26->27 28 gini = 0.0 samples = 1 value = [0, 0, 0, 0, 1] class = c 26->28 31 gini = 0.0 samples = 2 value = [0, 0, 0, 0, 2] class = c 30->31 32 gini = 0.0 samples = 110 value = [0, 0, 110, 0, 0] class = t 30->32 35 service ≤ 51.5 gini = 0.027 samples = 3015 value = [2974, 0, 29, 4, 8] class = a 34->35 56 gini = 0.0 samples = 690 value = [0, 0, 0, 690, 0] class = a 34->56 36 diff_srv_rate ≤ 0.24 gini = 0.01 samples = 2989 value = [2974, 0, 11, 3, 1] class = a 35->36 47 attack_category ≤ 16.5 gini = 0.447 samples = 26 value = [0, 0, 18, 1, 7] class = t 35->47 37 src_bytes ≤ 8490992.0 gini = 0.005 samples = 2981 value = [2974, 0, 3, 3, 1] class = a 36->37 46 gini = 0.0 samples = 8 value = [0, 0, 8, 0, 0] class = t 36->46 38 attack_category ≤ 13.5 gini = 0.003 samples = 2978 value = [2974, 0, 0, 3, 1] class = a 37->38 45 gini = 0.0 samples = 3 value = [0, 0, 3, 0, 0] class = t 37->45 39 gini = 0.0 samples = 3 value = [0, 0, 0, 3, 0] class = a 38->39 40 attack_category ≤ 17.0 gini = 0.001 samples = 2975 value = [2974, 0, 0, 0, 1] class = a 38->40 41 src_bytes ≤ 784.5 gini = 0.012 samples = 159 value = [158, 0, 0, 0, 1] class = a 40->41 44 gini = 0.0 samples = 2816 value = [2816, 0, 0, 0, 0] class = a 40->44 42 gini = 0.0 samples = 1 value = [0, 0, 0, 0, 1] class = c 41->42 43 gini = 0.0 samples = 158 value = [158, 0, 0, 0, 0] class = a 41->43 48 src_bytes ≤ 947.0 gini = 0.42 samples = 10 value = [0, 0, 3, 0, 7] class = c 47->48 53 attack_category ≤ 18.0 gini = 0.117 samples = 16 value = [0, 0, 15, 1, 0] class = t 47->53 49 gini = 0.0 samples = 6 value = [0, 0, 0, 0, 6] class = c 48->49 50 attack_category ≤ 15.5 gini = 0.375 samples = 4 value = [0, 0, 3, 0, 1] class = t 48->50 51 gini = 0.0 samples = 3 value = [0, 0, 3, 0, 0] class = t 50->51 52 gini = 0.0 samples = 1 value = [0, 0, 0, 0, 1] class = c 50->52 54 gini = 0.0 samples = 15 value = [0, 0, 15, 0, 0] class = t 53->54 55 gini = 0.0 samples = 1 value = [0, 0, 0, 1, 0] class = a 53->55

Applying Artificial Neural Network Model

Applying ANN features selected using Information Gain

In [79]:
X = best_features_using_ig
y = dataset['attack_type']

X_train, X_test, y_train, y_test = train_test_split(X, y, test_size=0.2, random_state=42)
In [80]:
X_train.shape
Out[80]:
(100778, 5)
In [81]:
X_train.head()
Out[81]:
attack_category src_bytes service diff_srv_rate flag
95141 11 214 24 0.00 9
37486 9 0 49 0.06 5
34926 9 0 24 0.06 1
34589 11 257 24 0.00 9
11420 11 516 44 0.00 9
In [82]:
X_test.head()
Out[82]:
attack_category src_bytes service diff_srv_rate flag
378 11 36 12 0.00 9
32038 9 0 24 0.10 5
86399 9 0 47 0.06 5
74412 9 0 49 0.06 1
52951 15 0 49 0.00 4
In [83]:
# Normalize the input features
sc = StandardScaler()
X_train = sc.fit_transform(X_train)
X_test = sc.transform(X_test)
In [84]:
X_train
Out[84]:
array([[ 0.14415382, -0.00749435, -0.44179813, -0.34956447,  0.75141773],
       [-0.61684847, -0.00752856,  1.08774919, -0.01525403, -0.73563646],
       [-0.61684847, -0.00752856, -0.44179813, -0.01525403, -2.22269065],
       ...,
       [-0.61684847, -0.00752856, -0.44179813,  0.04046437, -2.22269065],
       [ 0.14415382, -0.00747917, -0.44179813, -0.34956447,  0.75141773],
       [ 0.14415382, -0.00752168, -1.17598084, -0.29384607,  0.75141773]])
In [85]:
X_test
Out[85]:
array([[ 0.14415382, -0.0075228 , -1.17598084, -0.34956447,  0.75141773],
       [-0.61684847, -0.00752856, -0.44179813,  0.2076196 , -0.73563646],
       [-0.61684847, -0.00752856,  0.9653854 , -0.01525403, -0.73563646],
       ...,
       [ 0.14415382, -0.00545349, -0.6865257 , -0.34956447,  0.75141773],
       [ 0.14415382, -0.00739862,  1.39365865, -0.34956447,  0.75141773],
       [-0.61684847, -0.00752856,  1.08774919, -0.01525403, -0.73563646]])
In [86]:
y_train.head()
Out[86]:
95141    1
37486    0
34926    0
34589    1
11420    1
Name: attack_type, dtype: int64
In [87]:
y_test.head()
Out[87]:
378      1
32038    0
86399    0
74412    0
52951    2
Name: attack_type, dtype: int64
In [88]:
model_based_on_ig_features = MLPClassifier(hidden_layer_sizes=(10, 5), activation='relu', solver='adam', max_iter=1000, random_state=1)


model_based_on_ig_features.fit(X_train, y_train)
Out[88]:
MLPClassifier(hidden_layer_sizes=(10, 5), max_iter=1000, random_state=1)
In [89]:
y_pred = model_based_on_ig_features.predict(X_test)
In [90]:
cm = confusion_matrix(y_test, y_pred)

sns.heatmap(cm, annot=True, cmap="Blues")
plt.title("Confusion Matrix")
plt.xlabel("Predicted Labels")
plt.ylabel("True Labels")
plt.savefig("cm_ann_ig.png")
plt.show()

Inference:

  1. The confusion matrix shows that most the values predicted successfully by the model.
  2. The row 3 column 1 value 17 show that True value is 2 but the model predicted as 0 are 17 values.
In [91]:
# Calculate accuracy, precision, recall, and F1 score
accuracy = accuracy_score(y_test, y_pred)
precision = precision_score(y_test, y_pred, average='weighted')
recall = recall_score(y_test, y_pred, average='weighted')
f1 = f1_score(y_test, y_pred, average='weighted')
error_rate = 1 - accuracy

# Print the results
print("Accuracy: {:.3f}".format(accuracy))
print("Precision: {:.3f}".format(precision))
print("Recall: {:.3f}".format(recall))
print("F1 Score: {:.3f}".format(f1))
print("Error Rate: {:.3f}".format(error_rate))
Accuracy: 0.999
Precision: 0.999
Recall: 0.999
F1 Score: 0.999
Error Rate: 0.001

Apply ANN Model on the Features Selected by Correlation Matrix

In [92]:
X = best_feautres_using_corr
y = dataset['attack_type']

X_train, X_test, y_train, y_test = train_test_split(X, y, test_size=0.2, random_state=42)
In [93]:
# Normalize the input features
sc = StandardScaler()
X_train = sc.fit_transform(X_train)
X_test = sc.transform(X_test)
In [94]:
X_train
Out[94]:
array([[-0.62456242, -0.63942029, -0.63170499, -0.63715936,  0.77143339],
       [ 1.61966297,  1.60875752,  1.60574115,  1.60288857, -1.48038983],
       [-0.62456242, -0.63942029, -0.63170499, -0.63715936, -1.43489845],
       ...,
       [-0.62456242, -0.63942029, -0.63170499, -0.63715936, -1.45764414],
       [-0.62456242, -0.63942029, -0.63170499, -0.63715936,  0.77143339],
       [-0.62456242, -0.63942029, -0.63170499, -0.63715936,  0.77143339]])
In [95]:
X_test
Out[95]:
array([[-0.62456242, -0.63942029, -0.63170499, -0.63715936,  0.77143339],
       [ 1.61966297,  1.60875752,  1.60574115,  1.60288857, -0.9117476 ],
       [ 1.61966297,  1.60875752,  1.60574115,  1.60288857, -1.34391569],
       ...,
       [-0.62456242, -0.63942029, -0.63170499, -0.63715936,  0.77143339],
       [-0.57967791, -0.59445673, -0.63170499, -0.63715936,  0.77143339],
       [ 1.61966297,  1.60875752,  1.60574115,  1.60288857, -1.27567863]])
In [96]:
y_train.head()
Out[96]:
95141    1
37486    0
34926    0
34589    1
11420    1
Name: attack_type, dtype: int64
In [97]:
y_test.head()
Out[97]:
378      1
32038    0
86399    0
74412    0
52951    2
Name: attack_type, dtype: int64
In [98]:
model_based_on_corr_features = MLPClassifier(hidden_layer_sizes=(10, 5), activation='logistic', solver='adam', max_iter=1000, random_state=1)


model_based_on_corr_features.fit(X_train, y_train)
Out[98]:
MLPClassifier(activation='logistic', hidden_layer_sizes=(10, 5), max_iter=1000,
              random_state=1)
In [99]:
y_pred = model_based_on_ig_features.predict(X_test)
In [100]:
cm = confusion_matrix(y_test, y_pred)
# plot confusion matrix
sns.heatmap(cm, annot=True, cmap="Blues")
plt.title("Confusion Matrix")
plt.xlabel("Predicted Labels")
plt.ylabel("True Labels")
plt.savefig("cm_ann_corr.png")
plt.show()

Inference:

  1. The confusion matrix, F1 score and Error rate shows that features selected based on the Correlation matrix are not good.
  2. They are giving to less accuracy which is not acceptable.
In [101]:
# Calculate accuracy, precision, recall, and F1 score
accuracy = accuracy_score(y_test, y_pred)
precision = precision_score(y_test, y_pred, average='weighted')
recall = recall_score(y_test, y_pred, average='weighted')
f1 = f1_score(y_test, y_pred, average='weighted')

# Print the results
print("Accuracy: {:.3f}".format(accuracy))
print("Precision: {:.3f}".format(precision))
print("Recall: {:.3f}".format(recall))
print("F1 Score: {:.3f}".format(f1))
Accuracy: 0.134
Precision: 0.619
Recall: 0.134
F1 Score: 0.116
/home/jawad_ahmed/anaconda3/lib/python3.7/site-packages/sklearn/metrics/_classification.py:1318: UndefinedMetricWarning: Precision is ill-defined and being set to 0.0 in labels with no predicted samples. Use `zero_division` parameter to control this behavior.
  _warn_prf(average, modifier, msg_start, len(result))

Applying KNN Model

Applying KNN on Features Selected By Correlation Matrix

In [102]:
X = best_feautres_using_corr
y = dataset['attack_type']

X_train, X_test, y_train, y_test = train_test_split(X, y, test_size=0.2, random_state=42)
In [103]:
# Create a KNN model with k=3
knn = KNeighborsClassifier(n_neighbors=5)

knn.fit(X_train, y_train)

y_pred = knn.predict(X_test)

# Evaluate the model's accuracy
accuracy = knn.score(X_test, y_test)
print("Accuracy:", accuracy)
Accuracy: 0.8744195276840643

Applying Grid Search To Select Best Value of K

In [104]:
X = best_feautres_using_corr
y = dataset['attack_type']

X_train, X_test, y_train, y_test = train_test_split(X, y, test_size=0.2, random_state=42)
In [105]:
# Create a KNN model
knn = KNeighborsClassifier()

# Define the grid of hyperparameters to search over
param_grid = {'n_neighbors': [1, 3, 5, 7, 9, 11]}

# Create a grid search object
grid_search = GridSearchCV(knn, param_grid, cv=5)

# Train the grid search object using the training set
grid_search.fit(X_train, y_train)

# Print the best parameters and best score
print("Best parameters:", grid_search.best_params_)
print("Best score:", grid_search.best_score_)
Best parameters: {'n_neighbors': 11}
Best score: 0.8057527770613231
In [106]:
knn = KNeighborsClassifier(n_neighbors=11)

# Train the model using the training set
knn.fit(X_train, y_train)

# Make predictions on the testing set
y_pred = knn.predict(X_test)

Confusion Matrix For Performance Evaluation

In [107]:
cm = confusion_matrix(y_test, y_pred)
# plot confusion matrix
sns.heatmap(cm, annot=True, cmap="Blues")
plt.title("Confusion Matrix")
plt.xlabel("Predicted Labels")
plt.ylabel("True Labels")
plt.savefig("cm_knn_corr.png")
plt.show()
In [108]:
# Calculate accuracy, precision, recall, and F1 score
accuracy = accuracy_score(y_test, y_pred)
precision = precision_score(y_test, y_pred, average='weighted')
recall = recall_score(y_test, y_pred, average='weighted')
f1 = f1_score(y_test, y_pred, average='weighted')

# Print the results
print("Accuracy: {:.3f}".format(accuracy))
print("Precision: {:.3f}".format(precision))
print("Recall: {:.3f}".format(recall))
print("F1 Score: {:.3f}".format(f1))
Accuracy: 0.880
Precision: 0.882
Recall: 0.880
F1 Score: 0.862
/home/jawad_ahmed/anaconda3/lib/python3.7/site-packages/sklearn/metrics/_classification.py:1318: UndefinedMetricWarning: Precision is ill-defined and being set to 0.0 in labels with no predicted samples. Use `zero_division` parameter to control this behavior.
  _warn_prf(average, modifier, msg_start, len(result))

Applying KNN on Features Selected Using Information Gain

In [109]:
X = best_features_using_ig
y = dataset['attack_type']

X_train, X_test, y_train, y_test = train_test_split(X, y, test_size=0.2, random_state=42)
In [110]:
# Create a KNN model
knn = KNeighborsClassifier()

# Define the grid of hyperparameters to search over
param_grid = {'n_neighbors': [1, 3, 5, 7, 9, 11]}

# Create a grid search object
grid_search = GridSearchCV(knn, param_grid, cv=5)

# Train the grid search object using the training set
grid_search.fit(X_train, y_train)

# Print the best parameters and best score
print("Best parameters:", grid_search.best_params_)
print("Best score:", grid_search.best_score_)
Best parameters: {'n_neighbors': 1}
Best score: 0.9989878742385923
In [111]:
knn = KNeighborsClassifier(n_neighbors=1)

# Train the model using the training set
knn.fit(X_train, y_train)

# Make predictions on the testing set
y_pred = knn.predict(X_test)

Confusion Matrix For Performance Evaluation

In [112]:
cm = confusion_matrix(y_test, y_pred)
# plot confusion matrix
sns.heatmap(cm, annot=True, cmap="Blues")
plt.title("Confusion Matrix")
plt.xlabel("Predicted Labels")
plt.ylabel("True Labels")
plt.savefig("cm_knn_ig.png")
plt.show()

Inference:

  1. The confusion Matrix shows that most of the values are predicted correctly by the model.
  2. Thirty Six values that are not predicted by the model
In [113]:
# Calculate accuracy, precision, recall, and F1 score
accuracy = accuracy_score(y_test, y_pred)
precision = precision_score(y_test, y_pred, average='weighted')
recall = recall_score(y_test, y_pred, average='weighted')
f1 = f1_score(y_test, y_pred, average='weighted')

# Print the results
print("Accuracy: {:.3f}".format(accuracy))
print("Precision: {:.3f}".format(precision))
print("Recall: {:.3f}".format(recall))
print("F1 Score: {:.3f}".format(f1))
Accuracy: 0.999
Precision: 0.999
Recall: 0.999
F1 Score: 0.999

Applying K-Mean Clustering Model

Features Selected By Correlation Matrix

In [114]:
# Create a scaler object
scaler = StandardScaler()

# Fit and transform the data
scaled_data = scaler.fit_transform(best_feautres_using_corr)
In [115]:
sns.set_style('darkgrid')
%config InlineBackend.figure_format = 'retina'
In [116]:
# Visualize the correlation your data and identify variables for further analysis
g = sns.PairGrid(best_feautres_using_corr)
g.map(sns.scatterplot);

Elbow Method

In [117]:
fig, ax = plt.subplots(figsize=(20, 15))

# Determine optimal cluster number with elbow method
wcss = []

for i in range(1, 11):
    model = KMeans(n_clusters = i,     
                    init = 'k-means++',                 # Initialization method for kmeans
                    max_iter = 300,                     # Maximum number of iterations 
                    n_init = 10,                        # Choose how often algorithm will run with different centroid 
                    random_state = 0)                   # Choose random state for reproducibility
    model.fit(scaled_data)                              
    wcss.append(model.inertia_)
    
# Show Elbow plot
ax.plot(range(1, 11), wcss)
ax.set_title('Elbow Method')                               # Set plot title
ax.set_xlabel('Number of clusters')                        # Set x axis name
ax.set_ylabel('Within Cluster Sum of Squares (WCSS)')      # Set y axis name

# Save the plot as a PNG image
plt.savefig('elbow_plot.png', dpi=300)

plt.show()

Visualize the Scatter Plot

In [118]:
# Convert dataframe to numpy array
data = scaled_data

# Set the number of clusters
k = 4

# Initialize the k-means algorithm
kmeans = KMeans(n_clusters=k, random_state=0)

# Fit the algorithm to the data
labels = kmeans.fit_predict(data)

# Visualize the clusters in 3D
fig = plt.figure(figsize=(10,10))
ax = fig.add_subplot(111, projection='3d')
ax.scatter(data[:, 0], data[:, 1], data[:, 2], c=labels, cmap='rainbow')
ax.set_xlabel('Feature 1')
ax.set_ylabel('Feature 2')
ax.set_zlabel('Feature 3')
plt.title('K-Means Clustering with k=4')

# Save the graph
plt.savefig('kmeans_cluster.png')

# Show the graph
plt.show()

Applying K-Mean On the Feature Selected Using Information Gain

In [119]:
best_features_using_ig.head()
Out[119]:
attack_category src_bytes service diff_srv_rate flag
0 11 491 20 0.00 9
1 11 146 44 0.15 9
2 9 0 49 0.07 5
3 11 232 24 0.00 9
4 11 199 24 0.00 9
In [120]:
# Create a scaler object
scaler = StandardScaler()

# Fit and transform the data
scaled_data = scaler.fit_transform(best_features_using_ig)
In [121]:
# Visualize the correlation your data and identify variables for further analysis
g = sns.PairGrid(best_features_using_ig)
g.map(sns.scatterplot);

Elbow Method

In [122]:
fig, ax = plt.subplots(figsize=(20, 15))

# Determine optimal cluster number with elbow method
wcss = []

for i in range(1, 11):
    model = KMeans(n_clusters = i,     
                    init = 'k-means++',                 # Initialization method for kmeans
                    max_iter = 300,                     # Maximum number of iterations 
                    n_init = 10,                        # Choose how often algorithm will run with different centroid 
                    random_state = 0)                   # Choose random state for reproducibility
    model.fit(scaled_data)                              
    wcss.append(model.inertia_)
    
# Show Elbow plot
ax.plot(range(1, 11), wcss)
ax.set_title('Elbow Method')                               # Set plot title
ax.set_xlabel('Number of clusters')                        # Set x axis name
ax.set_ylabel('Within Cluster Sum of Squares (WCSS)')      # Set y axis name

# Save the plot as a PNG image
plt.savefig('elbow_plot.png', dpi=300)

plt.show()

Visualize the Scatter Plot

In [123]:
# Convert dataframe to numpy array
data = scaled_data

# Set the number of clusters
k = 8

# Initialize the k-means algorithm
kmeans = KMeans(n_clusters=k, random_state=0)

# Fit the algorithm to the data
labels = kmeans.fit_predict(data)

# Visualize the clusters in 3D
fig = plt.figure(figsize=(10,10))
ax = fig.add_subplot(111, projection='3d')
ax.scatter(data[:, 0], data[:, 1], data[:, 2], c=labels, cmap='rainbow')
ax.set_xlabel('Feature 1')
ax.set_ylabel('Feature 2')
ax.set_zlabel('Feature 3')
plt.title('K-Means Clustering with k=8')

# Save the graph
plt.savefig('kmeans_cluster_1.png')

plt.show()

Select Features Using PCA (Principle Component Analysis)

In [124]:
dataset_kmeans = dataset.drop('attack_type', axis=1)
In [125]:
dataset_kmeans.head()
Out[125]:
duration protocol_type service flag src_bytes dst_bytes land wrong_fragment urgent hot ... dst_host_same_srv_rate dst_host_diff_srv_rate dst_host_same_src_port_rate dst_host_srv_diff_host_rate dst_host_serror_rate dst_host_srv_serror_rate dst_host_rerror_rate dst_host_srv_rerror_rate attack_category occurance
0 0 1 20 9 491 0 0 0 0 0 ... 0.17 0.03 0.17 0.00 0.00 0.00 0.05 0.00 11 20
1 0 2 44 9 146 0 0 0 0 0 ... 0.00 0.60 0.88 0.00 0.00 0.00 0.00 0.00 11 15
2 0 1 49 5 0 0 0 0 0 0 ... 0.10 0.05 0.00 0.00 1.00 1.00 0.00 0.00 9 19
3 0 1 24 9 232 8153 0 0 0 0 ... 1.00 0.00 0.03 0.04 0.03 0.01 0.00 0.01 11 21
4 0 1 24 9 199 420 0 0 0 0 ... 1.00 0.00 0.00 0.00 0.00 0.00 0.00 0.00 11 21

5 rows × 43 columns

In [126]:
# Instantiate PCA
pca = PCA(n_components=3)

# Fit the PCA to the data
pca.fit(dataset_kmeans)

# Transform the data using the PCA
transformed_data = pca.transform(dataset_kmeans)

# Create a new DataFrame with the transformed data and column names
df_transformed = pd.DataFrame(data=transformed_data, columns=['Feature 1', 'Feature 2', 'Feature 3'])

# Print the explained variance ratio of the PCA
print('Explained variance ratio:', pca.explained_variance_ratio_)
Explained variance ratio: [6.80620901e-01 3.19378965e-01 1.33150173e-07]
In [127]:
df_transformed.head()
Out[127]:
Feature 1 Feature 2 Feature 3
0 -45080.955113 -19767.258863 -284.609780
1 -45425.955109 -19767.168071 -284.304068
2 -45571.955118 -19767.129666 -284.802112
3 -45337.809729 -11614.191028 -286.106906
4 -45372.844627 -19347.182064 -285.608626
In [128]:
# Create a scaler object
scaler = StandardScaler()

# Fit and transform the data
scaled_data = scaler.fit_transform(df_transformed)
In [129]:
scaled_data
Out[129]:
array([[-0.00767949, -0.0049157 , -0.10961518],
       [-0.00773826, -0.00491567, -0.10949744],
       [-0.00776313, -0.00491566, -0.10968926],
       ...,
       [-0.00738306, -0.00482032, -0.10956004],
       [-0.00776313, -0.00491566, -0.10969017],
       [-0.00773741, -0.00491567, -0.10962402]])
In [130]:
fig, ax = plt.subplots(figsize=(20, 15))

# Determine optimal cluster number with elbow method
wcss = []

for i in range(1, 11):
    model = KMeans(n_clusters = i,     
                    init = 'k-means++',                 # Initialization method for kmeans
                    max_iter = 300,                     # Maximum number of iterations 
                    n_init = 10,                        # Choose how often algorithm will run with different centroid 
                    random_state = 0)                   # Choose random state for reproducibility
    model.fit(scaled_data)                              
    wcss.append(model.inertia_)
    
# Show Elbow plot
ax.plot(range(1, 11), wcss)
ax.set_title('Elbow Method')                               # Set plot title
ax.set_xlabel('Number of clusters')                        # Set x axis name
ax.set_ylabel('Within Cluster Sum of Squares (WCSS)')      # Set y axis name

# Save the plot as a PNG image
plt.savefig('elbow_plot.png', dpi=300)

plt.show()
In [131]:
# Apply K-means clustering with k=6
kmeans = KMeans(n_clusters=6, random_state=0)
labels = kmeans.fit_predict(scaled_data)

# Visualize the clusters with a scatter plot of three features
fig = plt.figure(figsize=(10,10))
ax = fig.add_subplot(111, projection='3d')
ax.scatter(scaled_data[:, 0], scaled_data[:, 1], scaled_data[:, 2], c=labels, cmap='rainbow')
ax.set_xlabel('Feature 1')
ax.set_ylabel('Feature 2')
ax.set_zlabel('Feature 3')
plt.title('K-Means Clustering with k=6')

# Save the graph
plt.savefig('kmeans_cluster_2.png')

plt.show()
In [ ]:
 
In [ ]:
 
In [ ]:
 
In [ ]:
 
In [ ]:
 
In [ ]:
 
In [ ]:
 
In [ ]:
 
In [ ]:
 
In [ ]:
 
In [ ]:
 
In [ ]:
 
In [ ]:
 
In [ ]: